AUDIT_RESET_LOST(3) Linux Audit API AUDIT_RESET_LOST(3)

audit_reset_lost - reset lost event counter

#include <libaudit.h>

int audit_reset_lost(int fd);

audit_reset_lost() resets the kernel's lost event counter using the descriptor fd which must be an open audit netlink socket. This call requires that the kernel support AUDIT_FEATURE_BITMAP_LOST_RESET.

The return value is <= 0 on error, otherwise it is the netlink sequence id number.

audit_get_features(3), audit_open(3), auditctl(8).

Steve Grubb

July 2025 Red Hat