NAME         top

       auparse_normalize_get_event_kind, auparse_normalize_subject_kind, auparse_normalize_get_action, auparse_normalize_object_kind, auparse_normalize_how, auparse_normalize_session, auparse_normalize_subject_primary, auparse_normalize_subject_secondary, auparse_normalize_subject_first_attribute, auparse_normalize_subject_next_attribute, auparse_normalize_object_primary, auparse_normalize_object_secondary, auparse_normalize_object_primary2, auparse_normalize_object_first_attribute, auparse_normalize_object_next_attribute, auparse_normalize_get_results, auparse_normalize_key - Access normalized fields

SYNOPSIS         top

       #include <auparse.h>

       Metadata Functions:
       const char *auparse_normalize_get_event_kind(auparse_state_t *au);
       const char *auparse_normalize_subject_kind(auparse_state_t *au);
       const char *auparse_normalize_get_action(auparse_state_t *au);
       const char *auparse_normalize_object_kind(auparse_state_t *au);
       const char *auparse_normalize_how(auparse_state_t *au);

       Positioning Functions:
       int auparse_normalize_session(auparse_state_t *au);
       int auparse_normalize_subject_primary(auparse_state_t *au);
       int auparse_normalize_subject_secondary(auparse_state_t *au);
       int auparse_normalize_subject_first_attribute(auparse_state_t *au);
       int auparse_normalize_subject_next_attribute(auparse_state_t *au);
       int auparse_normalize_object_primary(auparse_state_t *au);
       int auparse_normalize_object_secondary(auparse_state_t *au);
       int auparse_normalize_object_primary2(auparse_state_t *au);
       int auparse_normalize_object_first_attribute(auparse_state_t *au);
       int auparse_normalize_object_next_attribute(auparse_state_t *au);
       int auparse_normalize_get_results(auparse_state_t *au);
       int auparse_normalize_key(auparse_state_t *au);

DESCRIPTION         top

       After calling the auparse_normalize function, you will probably want
       to access the audit event data. These function provide access to the
       results of the normalization. There are 2 kinds of function, metadata
       and positioning.

       The metadata functions all return a pointer to a string that
       describes something about the event. This data does not live inside
       the event but is kept in lookup tables inside the auparse library.

       The positioning function are different in that they move the internal
       cursor of auparse to the record and field that contains the
       information you want. You then use field accessor functions to
       retrieve the values.

RETURN VALUE         top

       The positioning functions return < 0 on error, 0 if uninitialized,
       and 1 on success. The metadata functions return NULL on error and a
       pointer to a string on success.

SEE ALSO         top

       auparse_normalize(3), auparse_get_field_str(3),

AUTHOR         top

       Steve Grubb

COLOPHON         top

       This page is part of the audit (Linux Audit) project.  Information
       about the project can be found at 
       ⟨⟩.  If you have a bug report
       for this manual page, send it to  This page
       was obtained from the project's upstream Git repository
       ⟨⟩ on 2017-11-25.
       (At that time, the date of the most recent commit that was found in
       the repository was 2017-11-16.)  If you discover any rendering prob‐
       lems in this HTML version of the page, or you believe there is a bet‐
       ter or more up-to-date source for the page, or you have corrections
       or improvements to the information in this COLOPHON (which is not
       part of the original manual page), send a mail to

Red Hat                          March 2017   AUPARSE_NORMALIZE_FUNCTIONS(3)