|
NAME | SYNOPSIS | DESCRIPTION | RETURN VALUE | SEE ALSO | AUTHOR | COLOPHON |
AUPARSE_NORMALIZE_FUNCTIONS(3) Linux Audit APIAUPARSE_NORMALIZE_FUNCTIONS(3)
auparse_normalize_get_event_kind, auparse_normalize_subject_kind, auparse_normalize_get_action, auparse_normalize_object_kind, auparse_normalize_how, auparse_normalize_session, auparse_normalize_subject_primary, auparse_normalize_subject_secondary, auparse_normalize_subject_first_attribute, auparse_normalize_subject_next_attribute, auparse_normalize_object_primary, auparse_normalize_object_secondary, auparse_normalize_object_first_attribute, auparse_normalize_object_next_attribute, auparse_normalize_get_results, auparse_normalize_key - Access normalized fields
#include <auparse.h>
Metadata Functions:
const char *auparse_normalize_get_event_kind(auparse_state_t *au);
const char *auparse_normalize_subject_kind(auparse_state_t *au);
const char *auparse_normalize_get_action(auparse_state_t *au);
const char *auparse_normalize_object_kind(auparse_state_t *au);
const char *auparse_normalize_how(auparse_state_t *au);
Positioning Functions:
int auparse_normalize_session(auparse_state_t *au);
int auparse_normalize_subject_primary(auparse_state_t *au);
int auparse_normalize_subject_secondary(auparse_state_t *au);
int auparse_normalize_subject_first_attribute(auparse_state_t *au);
int auparse_normalize_subject_next_attribute(auparse_state_t *au);
int auparse_normalize_object_primary(auparse_state_t *au);
int auparse_normalize_object_secondary(auparse_state_t *au);
int auparse_normalize_object_first_attribute(auparse_state_t *au);
int auparse_normalize_object_next_attribute(auparse_state_t *au);
int auparse_normalize_get_results(auparse_state_t *au);
int auparse_normalize_key(auparse_state_t *au);
After calling the auparse_normalize function, you will probably want
to access the audit event data. These function provide access to the
results of the normalization. There are 2 kinds of function, metadata
and positioning.
The metadata functions all return a pointer to a string that
describes something about the event. This data does not live inside
the event but is kept in lookup tables inside the auparse library.
The positioning function are different in that they move the internal
cursor of auparse to the record and field that contains the
information you want. You then use field accessor functions to
retrieve the values.
The positioning functions return < 0 on error, 0 if uninitialized,
and 1 on success. The metadata functions return NULL on error and a
pointer to a string on success.
auparse_normalize(3), auparse_get_field_str(3),
auparse_interpret_field(3).
Steve Grubb
This page is part of the audit (Linux Audit) project. Information
about the project can be found at
⟨http://people.redhat.com/sgrubb/audit/⟩. If you have a bug report
for this manual page, send it to linux-audit@redhat.com. This page
was obtained from the project's upstream Git repository
⟨https://github.com/linux-audit/audit-userspace.git⟩ on 2017-07-05.
If you discover any rendering problems in this HTML version of the
page, or you believe there is a better or more up-to-date source for
the page, or you have corrections or improvements to the information
in this COLOPHON (which is not part of the original manual page),
send a mail to man-pages@man7.org
Red Hat March 2017 AUPARSE_NORMALIZE_FUNCTIONS(3)