Man page 9 : audit_log_end

audit_log_end - end one audit record

void audit_log_end(struct audit_buffer *  ab );

ab
    the audit_buffer

The netlink_* functions cannot be called inside an irq context, so the audit buffer is placed on a queue and a tasklet is scheduled to remove them from the queue outside the irq context. May be called in any context.