|
HTML rendering created 2024-06-26 by Michael Kerrisk, author of The Linux Programming Interface. For details of in-depth Linux/UNIX system programming training courses that I teach, look here. Hosting by jambit GmbH. |
|
|
NAME | SYNOPSIS | DESCRIPTION | RETURN VALUE | SEE ALSO | AUTHOR | COLOPHON |
|
|
|
AUPARSE_NO...E_FUNCTIONS(3) Linux Audit API AUPARSE_NO...E_FUNCTIONS(3)
auparse_normalize_get_event_kind, auparse_normalize_subject_kind, auparse_normalize_get_action, auparse_normalize_object_kind, auparse_normalize_how, auparse_normalize_session, auparse_normalize_subject_primary, auparse_normalize_subject_secondary, auparse_normalize_subject_first_attribute, auparse_normalize_subject_next_attribute, auparse_normalize_object_primary, auparse_normalize_object_secondary, auparse_normalize_object_primary2, auparse_normalize_object_first_attribute, auparse_normalize_object_next_attribute, auparse_normalize_get_results, auparse_normalize_key - Access normalized fields
#include <auparse.h>
Metadata Functions:
const char *auparse_normalize_get_event_kind(const auparse_state_t *au);
const char *auparse_normalize_subject_kind(const auparse_state_t *au);
const char *auparse_normalize_get_action(const auparse_state_t *au);
const char *auparse_normalize_object_kind(const auparse_state_t *au);
const char *auparse_normalize_how(const auparse_state_t *au);
Positioning Functions:
int auparse_normalize_session(auparse_state_t *au);
int auparse_normalize_subject_primary(auparse_state_t *au);
int auparse_normalize_subject_secondary(auparse_state_t *au);
int auparse_normalize_subject_first_attribute(auparse_state_t *au);
int auparse_normalize_subject_next_attribute(auparse_state_t *au);
int auparse_normalize_object_primary(auparse_state_t *au);
int auparse_normalize_object_secondary(auparse_state_t *au);
int auparse_normalize_object_primary2(auparse_state_t *au);
int auparse_normalize_object_first_attribute(auparse_state_t *au);
int auparse_normalize_object_next_attribute(auparse_state_t *au);
int auparse_normalize_get_results(auparse_state_t *au);
int auparse_normalize_key(auparse_state_t *au);
After calling the auparse_normalize function, you will probably
want to access the audit event data. These function provide
access to the results of the normalization. There are 2 kinds of
function, metadata and positioning.
The metadata functions all return a pointer to a string that
describes something about the event. This data does not live
inside the event but is kept in lookup tables inside the auparse
library.
The positioning function are different in that they move the
internal cursor of auparse to the record and field that contains
the information you want. You then use field accessor functions
to retrieve the values.
The positioning functions return < 0 on error, 0 if
uninitialized, and 1 on success. The metadata functions return
NULL on error and a pointer to a string on success.
auparse_normalize(3), auparse_get_field_str(3),
auparse_interpret_field(3).
Steve Grubb
This page is part of the audit (Linux Audit) project.
Information about the project can be found at
⟨http://people.redhat.com/sgrubb/audit/⟩. If you have a bug
report for this manual page, send it to [email protected].
This page was obtained from the project's upstream Git repository
⟨https://github.com/linux-audit/audit-userspace.git⟩ on
2024-06-14. (At that time, the date of the most recent commit
that was found in the repository was 2024-06-12.) If you
discover any rendering problems in this HTML version of the page,
or you believe there is a better or more up-to-date source for
the page, or you have corrections or improvements to the
information in this COLOPHON (which is not part of the original
manual page), send a mail to [email protected]
Red Hat March 2017 AUPARSE_NO...E_FUNCTIONS(3)
Pages that refer to this page: auparse_normalize(3)
|
HTML rendering created 2024-06-26 by Michael Kerrisk, author of The Linux Programming Interface. For details of in-depth Linux/UNIX system programming training courses that I teach, look here. Hosting by jambit GmbH. |
|