Section 3: library functions
NAME auparse_get_type_name – get record’s type translation SYNOPSIS #include <auparse.h> const char *auparse_get_type_name(auparse_state_t *au); DESCRIPTION The auparse_get_type_name function will return the text representation of the name of the current record type. RETURN VALUE The auparse_get_type_name function returns NULL on error; otherwise a pointer to a string. SEE ALSO auparse_get_type(3),auparse_next_record(3). AUTHOR Steve Grubb Index
NAME auparse_get_type – get record’s type SYNOPSIS #include <auparse.h> int auparse_get_type(auparse_state_t *au); DESCRIPTION auparse_get_type will return the integer value for the current record of the current event. RETURN VALUE auparse_get_type returns 0 if an error occurs; otherwise, the record’s type. SEE ALSO auparse_get_type_name(3),auparse_next_record(3). AUTHOR Steve Grubb Index
NAME auparse_get_timestamp – access timestamp of the event SYNOPSIS #include <auparse.h> const au_event_t *auparse_get_timestamp(auparse_state_t *au); DESCRIPTION auparse_get_timestamp provides an accessor function for the event’s timestamp data structure. The data structure is as follows: typedef struct { time_t sec; // Event seconds unsigned int milli; // millisecond of the timestamp unsigned long serial; // Serial number…
NAME auparse_get_time – get event’s time SYNOPSIS #include <auparse.h> time_t auparse_get_time(auparse_state_t *au); DESCRIPTION auparse_get_time will access just the time portion of the timestamp data structure for the current event. RETURN VALUE Returns 0 if an error occurs; otherwise, the valid time value in time_t format. SEE ALSO time(3), auparse_get_timestamp(3), auparse_get_milli(3). auparse_get_serial(3). auparse_get_node(3). AUTHOR Steve Grubb…
NAME auparse_get_serial – get the event’s serial number SYNOPSIS #include <auparse.h> unsigned long auparse_get_serial(auparse_state_t *au); DESCRIPTION auparse_get_serial gets the serial number value from the current event’s timestamp data structure. RETURN VALUE Returns 0 if an error occurs; otherwise, the serial number for the event. SEE ALSO auparse_get_timestamp(3), auparse_get_time(3), auparse_get_milli(3). auparse_get_node(3). AUTHOR Steve Grubb Index
NAME auparse_get_record_text – access unparsed record data SYNOPSIS #include <auparse.h> const char *auparse_get_record_text(auparse_state_t *au); DESCRIPTION auparse_get_record_text returns a pointer to the full unparsed record. RETURN VALUE Returns NULL if an error occurs; otherwise, a pointer to the record. SEE ALSO auparse_next_record(3). AUTHOR Steve Grubb Index
NAME auparse_get_record_num – get current record cursor location SYNOPSIS #include <auparse.h> unsigned int auparse_get_record_num(auparse_state_t *au); DESCRIPTION auparse_get_record_num will retreive the internal library cursors current record location in the current event. Records within the same event are numbered starting from 0. This is generally not needed but there are some cases where one may want to…
NAME auparse_get_num_records – get the number of records SYNOPSIS #include <auparse.h> unsigned int auparse_get_num_records(auparse_state_t *au); DESCRIPTION auparse_get_num_records gets the number of records in the current event. RETURN VALUE Returns 0 if an error occurs; otherwise, the number of records. SEE ALSO auparse_next_record(3). AUTHOR Steve Grubb Index
NAME auparse_get_num_fields – get the number of fields SYNOPSIS #include <auparse.h> unsigned int auparse_get_num_fields(auparse_state_t *au); DESCRIPTION auparse_get_num_fields gets the number of fields in the current record of the current event. RETURN VALUE Returns 0 if an error occurs; otherwise, the number of fields. SEE ALSO auparse_next_record(3). AUTHOR Steve Grubb Index
NAME auparse_get_node – get the event’s machine node name SYNOPSIS #include <auparse.h> const char *auparse_get_node(auparse_state_t *au); DESCRIPTION auparse_get_node gets the machine’s node name if it exists in the audit event from the current event’s timestamp data structure. Not all records have node names since its an admin configurable option. RETURN VALUE Returns a copy of…
NAME auparse_get_milli – get the millisecond value of the event SYNOPSIS #include <auparse.h> unsigned int auparse_get_milli(auparse_state_t *au); DESCRIPTION auparse_get_milli gets the millisecond value of the current event. RETURN VALUE Returns 0 if an error occurs; otherwise, the value of the millisecond portion of the timestamp. SEE ALSO auparse_get_timestamp(3), auparse_get_time(3). auparse_get_milli(3). auparse_get_node(3). AUTHOR Steve Grubb Index
NAME auparse_get_line_number – get line number where record was found SYNOPSIS #include <auparse.h> unsigned int auparse_get_line_number(auparse_state_t *au); DESCRIPTION auparse_get_line_number will return the source input line number for the current record of the current event. Line numbers start at 1. If the source input type is AUSOURCE_FILE_ARRAY the line numbering will reset back to 1 each…
NAME auparse_get_filename – get the filename where record was found SYNOPSIS #include <auparse.h> const char *auparse_get_filename(auparse_state_t *au); DESCRIPTION auparse_get_filename will return the name of the source file where the record was found if the source type is AUSOURCE_FILE or AUSOURCE_FILE_ARRAY. For other source types the return value will be NULL. RETURN VALUE Returns pointer to…
NAME auparse_get_field_type – get current field’s data type SYNOPSIS #include <auparse.h> int auparse_get_field_type(auparse_state_t *au); DESCRIPTION auparse_get_field_type returns a value from the auparse_type_t enum that describes the kind of data in the current field of the current record in the current event. RETURN VALUE Returns AUPARSE_TYPE_UNCLASSIFIED if the field’s data type has no known description or…
NAME auparse_get_field_str – get current field’s value SYNOPSIS #include <auparse.h> const char *auparse_get_field_str(auparse_state_t *au); DESCRIPTION auparse_get_field_str allows access to the value in the current field of the current record in the current event. RETURN VALUE Returns NULL if an error occurs; otherwise, a pointer to the field’s value. SEE ALSO auparse_get_field_name(3), auparse_get_field_int(3), auparse_interpret_field(3), auparse_next_field(3). AUTHOR…
NAME auparse_get_field_num – get current field cursor location SYNOPSIS #include <auparse.h> unsigned int auparse_get_field_num(auparse_state_t *au); DESCRIPTION auparse_get_field_num will retreive the internal library cursors current field location in the current record. Fields within the same record are numbered starting from 0. This is generally not needed but there are some cases where one may want to…
NAME auparse_get_field_name – get current field’s name SYNOPSIS #include <auparse.h> const char *auparse_get_field_name(auparse_state_t *au); DESCRIPTION auparse_get_field_name allows access to the current field name of the current record in the current event. RETURN VALUE Returns NULL if an error occurs; otherwise, a pointer to the field’s name. SEE ALSO auparse_get_field_str(3), auparse_interpret_field(3), auparse_next_field(3). AUTHOR Steve Grubb Index
NAME auparse_get_field_int – get current field’s value as an int SYNOPSIS #include <auparse.h> int auparse_get_field_int(auparse_state_t *au); DESCRIPTION auparse_get_field_int allows access to the value as an int of the current field of the current record in the current event. RETURN VALUE Returns -1 if there is an error with errno set appropriately or the value if…
NAME auparse_flush_feed – flush any unconsumed feed data through parser. SYNOPSIS #include <auparse.h> int auparse_flush_feed(auparse_state_t *au); DESCRIPTION auparse_flush_feed should be called to signal the end of feed input data and flush any pending parse data through the parsing system. RETURN VALUE Returns -1 if an error occurs; otherwise, 0 for success. SEE ALSO auparse_feed(3), auparse_feed_age_events(3),…
NAME auparse_first_record – reposition record cursor SYNOPSIS #include <auparse.h> int auparse_first_record(auparse_state_t *au); DESCRIPTION auparse_first_record repositions the internal cursors of the parsing library to point to the first field of the first record in the current event. RETURN VALUE Returns -1 if an error occurs, 0 if there is no event data, or 1 for success….