Movatterモバイル変換

auparse_normalize_functions(3) — Linux manual page

AUPARSE_NO...E_FUNCTIONS(3)  Linux Audit APIAUPARSE_NO...E_FUNCTIONS(3)

NAME        top

       auparse_normalize_get_event_kind, auparse_normalize_subject_kind, auparse_normalize_get_action, auparse_normalize_object_kind, auparse_normalize_how, auparse_normalize_session, auparse_normalize_subject_primary, auparse_normalize_subject_secondary, auparse_normalize_subject_first_attribute, auparse_normalize_subject_next_attribute, auparse_normalize_object_primary, auparse_normalize_object_secondary, auparse_normalize_object_primary2, auparse_normalize_object_first_attribute, auparse_normalize_object_next_attribute, auparse_normalize_get_results, auparse_normalize_key - Access normalized fields

SYNOPSIS        top

#include <auparse.h>       Metadata Functions:const char *auparse_normalize_get_event_kind(const auparse_state_t *au);const char *auparse_normalize_subject_kind(const auparse_state_t *au);const char *auparse_normalize_get_action(const auparse_state_t *au);const char *auparse_normalize_object_kind(const auparse_state_t *au);const char *auparse_normalize_how(const auparse_state_t *au);       Positioning Functions:int auparse_normalize_session(auparse_state_t *au);int auparse_normalize_subject_primary(auparse_state_t *au);int auparse_normalize_subject_secondary(auparse_state_t *au);int auparse_normalize_subject_first_attribute(auparse_state_t *au);int auparse_normalize_subject_next_attribute(auparse_state_t *au);int auparse_normalize_object_primary(auparse_state_t *au);int auparse_normalize_object_secondary(auparse_state_t *au);int auparse_normalize_object_primary2(auparse_state_t *au);int auparse_normalize_object_first_attribute(auparse_state_t *au);int auparse_normalize_object_next_attribute(auparse_state_t *au);int auparse_normalize_get_results(auparse_state_t *au);int auparse_normalize_key(auparse_state_t *au);

DESCRIPTION        top

       After calling theauparse_normalizefunction, you will probably       want to access the audit event data. These function provide access       to the results of the normalization. There are 2 kinds of       function, metadata and positioning.       The metadata functions all return a pointer to a string that       describes something about the event. This data does not live       inside the event but is kept in lookup tables inside the auparse       library.       The positioning function are different in that they move the       internal cursor of auparse to the record and field that contains       the information you want. You then use field accessor functions to       retrieve the values.

RETURN VALUE        top

       The positioning functions return < 0 on error, 0 if uninitialized,       and 1 on success. The metadata functions return NULL on error and       a pointer to a string on success.

SEE ALSO        top

auparse_normalize(3),auparse_get_field_str(3),auparse_interpret_field(3).

AUTHOR        top

       Steve Grubb

COLOPHON        top

       This page is part of theaudit (Linux Audit) project.  Information       about the project can be found at        ⟨http://people.redhat.com/sgrubb/audit/⟩.  If you have a bug report       for this manual page, send it to linux-audit@redhat.com.  This       page was obtained from the project's upstream Git repository       ⟨https://github.com/linux-audit/audit-userspace.git⟩ on       2025-08-11.  (At that time, the date of the most recent commit       that was found in the repository was 2025-08-09.)  If you discover       any rendering problems in this HTML version of the page, or you       believe there is a better or more up-to-date source for the page,       or you have corrections or improvements to the information in this       COLOPHON (which isnot part of the original manual page), send a       mail to man-pages@man7.orgRed Hat                         March 2017AUPARSE_NO...E_FUNCTIONS(3)

Pages that refer to this page:auparse_normalize(3)

HTML rendering created 2025-09-06 byMichael Kerrisk, author ofThe Linux Programming Interface. For details of in-depthLinux/UNIX system programming training courses that I teach, lookhere. Hosting byjambit GmbH.