audit_set_status
err = audit_set_status(fd, AUDIT_STATUS_ENABLED, 1);
err = audit_set_status(fd, AUDIT_STATUS_PID, getpid());