|
HTML rendering created 2026-09-09 by Michael Kerrisk, author of The Linux Programming Interface. For details of in-depth Linux/UNIX system programming training courses that I teach, look here. Hosting by jambit GmbH. |
|
|
NAME | SYNOPSIS | DESCRIPTION | RETURN VALUE | ERRORS | EXAMPLE | SEE ALSO | AUTHOR | COLOPHON |
|
|
|
AUPARSE_FEED(3) Linux Audit API AUPARSE_FEED(3)
auparse_feed - feed data into parser
#include <auparse.h>
int auparse_feed(auparse_state_t *au,constchar*"data,size_t"data_len);"
au The audit parse state
data a buffer of data to feed into the parser, it is data_len
bytes long. The data is copied in the parser, upon return
the caller may free or reuse the data buffer.
data_len
number of bytes in data
auparse_feed supplies new data for the parser to consume.
auparse_init() must have been called with a source type of
AUSOURCE_FEED and a NULL pointer. auparse_add_callback() must be
called before feeding data so that complete events have a
consumer.
The parser consumes as much data as it can invoking a user
supplied callback specified with auparse_add_callback with a
cb_event_type of AUPARSE_CB_EVENT_READY each time the parser
recognizes a complete event in the data stream. Data not fully
parsed will persist and be prepended to the next feed data. After
all data has been feed to the parser auparse_flush_feed should be
called to signal the end of input data and flush any pending parse
data through the parsing system. Malformed feed records are
rejected and are not passed to the callback. If malformed records
are found, parsing continues for the rest of the available feed
data before auparse_feed returns an error.
Returns -1 if an error occurs; otherwise, 0 for success. When -1
is returned, errno is set to indicate the error. The value of
errno is meaningful only after an error return; callers should not
assume it is cleared after a successful call. Applications that
may run with libauparse from before audit-4.1.5 should set errno
to 0 before calling auparse_feed. If auparse_feed returns -1 and
errno is still 0, the runtime library is using the older error
behavior and did not set errno. Clearing errno first avoids
treating a pre-existing value as if it were set by auparse_feed.
EINVAL The parser state is invalid, the parser was not initialized
with AUSOURCE_FEED, the input arguments are invalid, or no
callback has been registered.
ENOMEM Memory allocation failed while buffering or parsing feed
data.
EBADMSG
A malformed feed record was found. The malformed record was
rejected and was not passed to the callback. Parsing
continues for the rest of the available feed data before
this error is returned.
EIO An internal parser failure occurred without a more specific
error code.
void
auparse_callback(auparse_state_t *au, auparse_cb_event_t cb_event_type,
void *user_data)
{
int *event_cnt = (int *)user_data;
if (cb_event_type == AUPARSE_CB_EVENT_READY) {
if (auparse_first_record(au) <= 0) return;
printf("event: %d\n", *event_cnt);
printf("records:%d\n", auparse_get_num_records(au));
do {
printf("fields:%d\n", auparse_get_num_fields(au));
printf("type=%d ", auparse_get_type(au));
const au_event_t *e = auparse_get_timestamp(au);
if (e == NULL) return;
printf("event time: %lu.%u:%lu\n",
(long unsigned)e->sec, e->milli, e->serial);
auparse_first_field(au);
do {
printf("%s=%s (%s)\n", auparse_get_field_name(au),
auparse_get_field_str(au),
auparse_interpret_field(au));
} while (auparse_next_field(au) > 0);
printf("\n");
} while(auparse_next_record(au) > 0);
(*event_cnt)++;
}
}
main(int argc, char **argv)
{
char *filename = argv[1];
FILE *fp;
char buf[256];
size_t len;
int *event_cnt = malloc(sizeof(int));
au = auparse_init(AUSOURCE_FEED, 0);
auparse_set_eoe_timeout(2);
*event_cnt = 1;
auparse_add_callback(au, auparse_callback, event_cnt, free);
if ((fp = fopen(filename, "r")) == NULL) {
fprintf(stderr, "could not open '%s', %s\n", filename, strerror(errno));
return 1;
}
while ((len = fread(buf, 1, sizeof(buf), fp))) {
auparse_feed(au, buf, len);
}
auparse_flush_feed(au);
auparse_destroy(au);
}
auparse_add_callback(3), auparse_flush_feed(3),
auparse_feed_age_events(3), auparse_feed_has_data(3),
auparse_metrics(3)
John Dennis
This page is part of the audit (Linux Audit) project. Information
about the project can be found at
⟨http://people.redhat.com/sgrubb/audit/⟩. If you have a bug report
for this manual page, send it to linux-audit@redhat.com. This
page was obtained from the project's upstream Git repository
⟨https://github.com/linux-audit/audit-userspace.git⟩ on
2026-08-03. (At that time, the date of the most recent commit
that was found in the repository was 2026-07-29.) If you discover
any rendering problems in this HTML version of the page, or you
believe there is a better or more up-to-date source for the page,
or you have corrections or improvements to the information in this
COLOPHON (which is not part of the original manual page), send a
mail to man-pages@man7.org
Red Hat Sept 2023 AUPARSE_FEED(3)
Pages that refer to this page: auparse_add_callback(3), auparse_feed_age_events(3), auparse_feed_has_data(3), auparse_flush_feed(3), auparse_init(3), auparse_metrics(3), auplugin(3), auditd-plugins(5)
|
HTML rendering created 2026-09-09 by Michael Kerrisk, author of The Linux Programming Interface. For details of in-depth Linux/UNIX system programming training courses that I teach, look here. Hosting by jambit GmbH. |
|