AU_EVENT(3)

💅 AU_EVENT(3) — the audit event database lookup girlies ✨

ok so this is the AU_EVENT(3) manual page, bestie, straight out of the libbsm Basic Security Module Library. it's giving "I know every audit event by name AND by number" energy and honestly? iconic. let's get into it 🎀

---

✨ NAME ✨

free_au_event_ent, setauevent, endauevent, getauevent, getauevent_r, getauevnam, getauevnam_r, getauevnum, getauevnum_r, getauevnonam, getauevnonam_r — these are your look-up girlies for pulling info out of the audit_event database 🌸

---

📚 LIBRARY 📚

Basic Security Module Library — libbsm, and you link it with -lbsm 💖

---

🦋 SYNOPSIS 🦋

ok so first you gotta invite them in:

#include <bsm/libbsm.h>

then it's just a whole friend group of function signatures, no cap:

void
setauevent(void);

void
endauevent(void);

struct au_event_ent *
getauevent(void);

struct au_event_ent *
getauevent_r(struct au_event_ent *e);

struct au_event_ent *
getauevnam(const char *name);

struct au_event_ent *
getauevnam_r(struct au_event_ent *e, const char *name);

struct au_event_ent *
getauevnum(au_event_t event_number);

struct au_event_ent *
getauevnum_r(struct au_event_ent *e, au_event_t event_number);

au_event_t *
getauevnonam(const char *event_name);

au_event_t *
getauevnonam_r(au_event_t *ev, const char *event_name);

---

🌈 DESCRIPTION 🌈

these interfaces let you peek inside the audit_event(5) database, which is literally the database that describes audit events. every entry in there is described by a struct au_event_ent, and you get those entries handed to you by calling getauevent(), getauevnam(), or getauevnum(). and plot twist — you can also go the other way and look up an event number by calling getauevnonam() 👑

let's meet the cast, one by one:

• setauevent() — resets the database access session for audit_event(5), so the next getauevent() call starts over at the very first entry in the database. it's the "ok let's rewind, bestie" function 🔁
• endauevent() — closes the audit_event(5) database session. say bye 👋
• getauevent() — returns a reference to the next entry in the audit_event(5) database. it iterates, she slays.
• getauevnam() — returns a reference to the entry in the audit_event(5) database whose name is name. searching by name, we love to see it 💅
• getauevnum() — returns a reference to the entry in the audit_event(5) database whose event number is event_number. numbers era 🔢
• getauevnonam() — returns a reference to an audit event number, using the audit_event(5) database. full circle moment 🫶

---

💀 RETURN VALUES 💀

so getauevent(), getauevent_r(), getauevnam(), getauevnam_r(), getauevnum(), getauevnum_r(), and getauevnonam() all return a reference to a struct au_event_ent or an au_event_t when things go right ✨ — or NULL when they don't 😭, and in that case errno is set to give you more deets about what went wrong.

---

🧚 SEE ALSO 🧚

• libbsm(3)
• audit_event(5)

go read those too, iykyk 📖

---

🎀 HISTORY 🎀

the OpenBSM implementation was created by McAfee Research — that's the security division of McAfee Inc. — working under contract to Apple Computer, Inc., back in 2004. it then got adopted by the TrustedBSD Project as the foundation for the OpenBSM distribution. glow-up story fr fr 🌟

---

👑 AUTHORS 👑

this software was created by Robert Watson, Wayne Salamon, and Suresh Krishnaswamy for McAfee Research, the security research division of McAfee, Inc., under contract to Apple Computer, Inc. 🫶

and the Basic Security Module (BSM) interface to audit records and the audit event stream format were defined by Sun Microsystems. legends only ⭐

---

🙈 BUGS 🙈

heads up bestie, errno is not always properly set after a failure. so like… don't fully trust it every single time 💀

also these routines are thread-safe but not re-entrant, so if you use them simultaneously or in an interleaved way, that's gonna mess with the iterator. no cap, the iterator is shared and she will get confused 😭

---

and that's the whole page!! this one's from the Debian crowd, dated April 19, 2005, filed under AU_EVENT(3) — mwah, stan libbsm, bye bestie 💖✨🎀🦋