On Wednesday, January 19, 2011 05:30:15 am Ashok Kumar J wrote: If you look in lib/private.h extern int audit_send(int fd, int type, const void *data, unsigned int size) hidden; Its a hidden function that is not part of the public API and that is why there is no man page. What it sends to the kernel is: struct audit_message { struct nlmsghdr nlh; char data[MAX_AUDIT_MESSAGE_LENGTH]; }; The data format varies with each kind of command sent. The commands are found in /usr/include/linux/audit.h with a numeric value between 1000 and 1099. Some commands have lots of data, such as the ADD_RULE command. However, some have no data, such as the LIST_RULES command. This is not documented in man pages because the logic is embodied in the library and it was never anticpated that the audit system be operated without at least libaudit. -Steve