Section 3: library functions
ausearch_set_stop – set the cursor position Synopsis#include <auparse.h> int ausearch_set_stop(auparse_state_t *au, austop_t where); Descriptionausearch_set_stop determines where the internal cursor will stop when a search condition is met. The possible values are: AUSEARCH_STOP_EVENT This one repositions the cursors to the first field of the first record of the event containing the items searched for. AUSEARCH_STOP_RECORD This…
ausearch_next_event – find the next event that meets search criteria Synopsis#include <auparse.h> int ausearch_next_event(auparse_state_t *au); Descriptionausearch_next_event will scan the input source and evaluate whether any record in an event contains the data being searched for. Evaluation is done at the record level. Return ValueReturns -1 if an error occurs, 0 if no matches, and 1…
ausearch_clear – clear search parameters Synopsis#include <auparse.h> void ausearch_clear(auparse_state_t *au); Descriptionausearch_clear clears any search parameters stored in the parser instance and frees memory associated with it. Return ValueNone. See Alsoausearch_add_item(3), ausearch_add_regex(3). AuthorSteve Grubb
ausearch_add_timestamp_item_ex – build up search rule Synopsis#include <auparse.h> int ausearch_add_timestamp_item_ex(auparse_state_t *au, const char *op, time_t sec, unsigned milli, unsigned serial, ausearch_rule_t how) Descriptionausearch_add_timestamp_item adds an event time condition to the current audit search expression. The search conditions can then be used to scan logs, files, or buffers for something of interest. The op parameter specifies…
ausearch_add_timestamp_item – build up search rule Synopsis#include <auparse.h> int ausearch_add_timestamp_item(auparse_state_t *au, const char *op, time_t sec, unsigned milli, ausearch_rule_t how) Descriptionausearch_add_timestamp_item adds an event time condition to the current audit search expression. The search conditions can then be used to scan logs, files, or buffers for something of interest. The op parameter specifies the desired…
ausearch_add_regex – use regular expression search rule Synopsis#include <auparse.h> int ausearch_add_regex(auparse_state_t *au, const char *expr); Descriptionausearch_add_regex adds one search condition based on a regular expression to the current audit search expression. The search conditions can then be used to scan logs, files, or buffers for something of interest. The regular expression follows the posix extended…
ausearch_add_item – build up search rule Synopsis#include <auparse.h> int ausearch_add_item(auparse_state_t *au, const char *field, const char *op, const char *value, ausearch_rule_t how); Descriptionausearch_add_item adds one search condition to the current audit search expression. The search conditions can then be used to scan logs, files, or buffers for something of interest. The field value is the…
ausearch_add_interpreted_item – build up search rule Synopsis#include <auparse.h> int ausearch_add_interpreted_item(auparse_state_t *au, const char *field, const char *op, const char *value, ausearch_rule_t how); Descriptionausearch_add_interpreted_item adds one search condition to the current audit search expression. The search conditions can then be used to scan logs, files, or buffers for something of interest. The field value is the…
ausearch_add_expression – build up search expression Synopsis#include <auparse.h> int ausearch_add_expression(auparse_state_t *au, const char *expression, char **error, ausearch_rule_t how); Descriptionausearch_add_item adds an expression to the current audit search expression. The search conditions can then be used to scan logs, files, or buffers for something of interest. The expression parameter contains an expression, as specified in ausearch-expression(5)….
auparse_timestamp_compare – compares timestamp values Synopsis#include <auparse.h> int auparse_timestamp_compare(au_event_t *e1, au_event_t *e2); Descriptionauparse_timestamp_compare compares the values of 2 timestamps. Return ValueReturns -1, 0, or 1 respectively depending on whether e2 is less than, equal to, or greater than e1. See Alsoauparse_get_timestamp(3). AuthorSteve Grubb
auparse_set_escape_mode – choose escape method Synopsis#include <auparse.h> void auparse_set_escape_mode(auparse_state_t *au, auparse_esc_t mode); Descriptionauparse_set_escape_mode is used to set the escaping method that will be used to output interpretted text. The choices for the mode variable are: AUPARSE_ESC_RAW No escaping of any kind is done. AUPARSE_ESC_TTY Escape TTY control characters so that they are harmless to display…
auparse_reset – reset audit parser instance Synopsis#include <auparse.h> int auparse_reset(auparse_state_t *au); Descriptionauparse_reset resets all internal cursors to the beginning. It closes files, descriptors, and frees memory buffers. Return ValueReturns -1 if an error occurs; otherwise, 0 for success. See Alsoauparse_init(3), auparse_destroy(3). AuthorSteve Grubb
auparse_normalize_get_event_kind, auparse_normalize_get_action, auparse_normalize_object_kind, auparse_normalize_how, auparse_normalize_session, auparse_normalize_subject_primary, auparse_normalize_subject_secondary, auparse_normalize_subject_first_attribute, auparse_normalize_subject_next_attribute, auparse_normalize_object_primary, auparse_normalize_object_secondary, auparse_normalize_object_first_attribute, auparse_normalize_object_next_attribute, auparse_normalize_get_results, auparse_normalize_key – Access normalized fieldsSynopsis#include <auparse.h> Metadata Functions: const char *auparse_normalize_get_event_kind(auparse_state_t *au); const char *auparse_normalize_get_action(auparse_state_t *au); const char *auparse_normalize_object_kind(auparse_state_t *au); const char *auparse_normalize_how(auparse_state_t *au); Positioning Functions: int auparse_normalize_session(auparse_state_t *au); int auparse_normalize_subject_primary(auparse_state_t *au); int auparse_normalize_subject_secondary(auparse_state_t *au); int auparse_normalize_subject_first_attribute(auparse_state_t *au); int auparse_normalize_subject_next_attribute(auparse_state_t *au);…
auparse_normalize – normalize the current event Synopsis#include <auparse.h> int auparse_normalize(auparse_state_t *au, normalize_option_t opt); Descriptionauparse_normalize analyzes the current event so that the important information about the event can be accessed through a normalized API which positions to internal field cursor to the exact record and field when asked about specific information. The auparse_normalize function takes an…
auparse_node_compare – compares node name values Synopsis#include <auparse.h> int auparse_node_compare(au_event_t *e1, au_event_t *e2); Descriptionauparse_node_compare compares the node name values of 2 events. Return ValueReturns -1, 0, or 1 respectively depending on whether e2 is less than, equal to, or greater than e1. Since this is a string compare, it probably only matter that they are…
auparse_next_record – move record cursor Synopsis#include <auparse.h> int auparse_next_record(auparse_state_t *au); Descriptionauparse_next_record will move the internal library cursors to point to the next record of the current event. You should not call this function from a feed interface callback function. Doing so will deadlock the code. In that scenario, you should check the number of records…
auparse_next_field – move field cursor Synopsis#include <auparse.h> int auparse_next_field(auparse_state_t *au); Descriptionauparse_next_field moves the library’s internal cursor to point to the next field in the current record of the current event. Return ValueReturns 0 if no more fields exist and 1 for success. See Alsoauparse_next_record(3). AuthorSteve Grubb
auparse_next_event – get the next event Synopsis#include <auparse.h> int auparse_next_event(auparse_state_t *au); Descriptionauparse_next_event will position the cursors at the first field of the first record of the next event in a file or buffer. It does not skip events or honor any search criteria that may be stored. Return ValueReturns -1 if an error occurs, 0…
auparse_interpret_field – get current field’s value interpreted Synopsis#include <auparse.h> const char *auparse_interpret_field(auparse_state_t *au); Descriptionauparse_interpret_field allows access to the interpreted value in the current field of the current record in the current event. The returned string is escaped using the chosen method. The returned value will be destroyed if you call this function again. If you…
auparse_init – initialize an instance of the audit parsing library Synopsis#include <auparse.h> auparse_state_t *auparse_init(ausource_t source, const void *b); Descriptionauparse_init initializes an instance of the audit parsing library. The function returns an opaque pointer to the parser’s internal state. It is used in subsequent calls to the library so. The source variable determines where the library…