Hi team,
I was working on leveraging the libaudit shared library to generate audit events from a
user space daemon. I have been using the audit_open as well as audit_log_acct_message()
API’s to send message to the kernel audit subsystem. From the man pages I understand that
every message to the kernel audit subsystem would get an ACK back. Now my question is does
the daemon[single threaded] consuming this libaudit for sending events using
audit_log_acct_message() API be blocked until it gets an ACK back from the kernel ?
If yes , is there a way to not have the application blocked during this period ?
Thanks,
Manoj