auparse_find_field(3) — Linux manual page

AUPARSE_FIND_FIELD(3)        Linux Audit API       AUPARSE_FIND_FIELD(3)

NAME

       auparse_find_field - search for field name

SYNOPSIS

       #include <auparse.h>

       const char *auparse_find_field(auparse_state_t *au, const char
       *name);

DESCRIPTION

       auparse_find_field will scan all records in an event to find the
       first occurrence of the field name passed to it. Searching begins
       from the cursor's current position. The field name is stored for
       subsequent searching.

       NOTE: auparse creates 2 pseudo fields that do not exist in the
       natural record for SELinux AVC and USER_AVC decision and
       permissions. The field names are seresult and seperms
       respectively.

RETURN VALUE

       Returns NULL field not found. If an error occurs errno will be
       set. Otherwise, it returns a pointer to the text value associated
       with the field.

SEE ALSO

       auparse_first_record(3), auparse_find_field_next(3).

AUTHOR

       Steve Grubb

COLOPHON

       This page is part of the audit (Linux Audit) project.
       Information about the project can be found at 
       ⟨http://people.redhat.com/sgrubb/audit/⟩.  If you have a bug
       report for this manual page, send it to linux-audit@redhat.com.
       This page was obtained from the project's upstream Git repository
       ⟨https://github.com/linux-audit/audit-userspace.git⟩ on
       2024-06-14.  (At that time, the date of the most recent commit
       that was found in the repository was 2024-06-12.)  If you
       discover any rendering problems in this HTML version of the page,
       or you believe there is a better or more up-to-date source for
       the page, or you have corrections or improvements to the
       information in this COLOPHON (which is not part of the original
       manual page), send a mail to man-pages@man7.org

Red Hat                         June 2021          AUPARSE_FIND_FIELD(3)

Pages that refer to this page: auparse_find_field_next(3)

---