<html dir="ltr"><head></head><body style="text-align:left; direction:ltr;"><div>Wajih,</div><div><br></div><div>Try </div><div> man audit_log_user_message</div><div>and note the need for CAP_AUDIT_WRITE ability (see auditctl(8))</div><div><br></div><div>That said. Is there a reason you want a message going into the system kernel logging mechanism? The only reason why I ask is, if your audit rules posture is aggressive (many rules that fire) then you could will slow down your application as it waits to insert a message into the NETLINK_SOCKET is uses.</div><div><br></div><div>On *nix, syslog is the normal destination for application event logs. By separating your application logs from operating system logs, you can more efficiently post process them.</div><div><br></div><div>Regards</div><div>On Fri, 2019-02-01 at 17:03 -0600, Wajih Ul Hassan wrote:</div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><div dir="ltr"><div class="gmail_default" style="font-family:tahoma,sans-serif">Hi,</div><div class="gmail_default" style="font-family:tahoma,sans-serif">Hi, I have a C application which needs to send a message to audit.log from userspace. I have been using `auditctl -m` format to send a message to audit.log using `system` command but it seems to degrade performance a lot of my application.</div><div class="gmail_default" style="font-family:tahoma,sans-serif">My question is there any API to send a message programmatically from my application which is more efficient and robust.</div><div class="gmail_default" style="font-family:tahoma,sans-serif">Thanks,<br>Wajih</div></div> <pre>--</pre><pre>Linux-audit mailing list</pre><pre><a href="mailto:Linux-audit@redhat.com">Linux-audit@redhat.com</a></pre><pre><a href="https://www.redhat.com/mailman/listinfo/linux-audit">https://www.redhat.com/mailman/listinfo/linux-audit</a></pre></blockquote></body></html>