I'm reading audit messages through a netlink socket but it seems that in Jessie running linux 3.16.0-4 the message length in the message header does not account the payload size, always get sizeof( struct nlmsghdr ) no matter how many bytes is read from socket.
Someone can point me in the direction to check this messages in the other end of this socket?