AUPARSE_FEED(3)

💖 NAME 💖

auparse_feed — bestie, it feeds data into the parser 🍼✨

---

🌸 SYNOPSIS 🌸

#include <auparse.h>

int auparse_feed(auparse_state_t *au,constchar*"data,size_t"data_len);"

• au — the audit parse state, aka the little guy you're feeding 🫶
• data — a buffer of data to feed into the parser, and it's data_len bytes long. The data gets copied into the parser, so once you return you can free it or reuse that buffer, no strings attached 💅
• data_len — number of bytes in data (yes, literally just counting the bytes, iconic)

---

🎀 DESCRIPTION 🎀

So auparse_feed supplies new data for the parser to consume. That's the whole job. That's the assignment. 💖

But before you go feeding anything, the prerequisites are not optional, bestie:

• auparse_init() must have been called with a source type of AUSOURCE_FEED and a NULL pointer. No AUSOURCE_FEED, no vibes.
• auparse_add_callback() must be called before feeding data so that complete events have a consumer. Someone has to receive these events, fr fr.

Here's the tea on how the parsing actually goes: the parser consumes as much data as it can, invoking a user supplied callback specified with auparse_add_callback with a cb_event_type of AUPARSE_CB_EVENT_READY each time the parser recognizes a complete event in the data stream. Every single time. Obsessed with the consistency honestly. ⭐

Data that isn't fully parsed doesn't get yeeted — it persists and gets prepended to the next feed data. 🌈

After all data has been feed to the parser, auparse_flush_feed should be called to signal the end of input data and flush any pending parse data through the parsing system. Don't forget this step, it's giving "left the party without saying bye" energy otherwise.

🚨 Malformed feed records are rejected and are not passed to the callback. If malformed records are found, parsing continues for the rest of the available feed data before auparse_feed returns an error. So it doesn't rage-quit, it finishes the job and then tells you. Queen behavior, honestly. 👑

---

✨ RETURN VALUE ✨

• Returns -1 if an error occurs; otherwise, 0 for success. Simple. Clean. Ate. 💅
• When -1 is returned, errno is set to indicate the error.
• The value of errno is meaningful only after an error return — callers should not assume it is cleared after a successful call. 🙈
• Applications that may run with libauparse from before audit-4.1.5 should set errno to 0 before calling auparse_feed. If auparse_feed returns -1 and errno is still 0, the runtime library is using the older error behavior and did not set errno. Clearing errno first avoids treating a pre-existing value as if it were set by auparse_feed. (Yes this is a whole thing, no it's not a drill, do the errno = 0 thing.) 🧚

---

💀 ERRORS 💀

• EINVAL — The parser state is invalid, the parser was not initialized with AUSOURCE_FEED, the input arguments are invalid, or no callback has been registered. Basically: you skipped a step, bestie 😭
• ENOMEM — Memory allocation failed while buffering or parsing feed data. The memory said no. 💀
• EBADMSG — A malformed feed record was found. The malformed record was rejected and was not passed to the callback. Parsing continues for the rest of the available feed data before this error is returned. It's giving "we found a problem, finished everything else, then filed the complaint" 🔥
• EIO — An internal parser failure occurred without a more specific error code. Mystery error. Not the fun kind of mystery. 🙈

---

🦋 EXAMPLE 🦋

Okay so here's the whole thing, copy it, love it, run it:

void
auparse_callback(auparse_state_t *au, auparse_cb_event_t cb_event_type,
                 void *user_data)
{
    int *event_cnt = (int *)user_data;

    if (cb_event_type == AUPARSE_CB_EVENT_READY) {
        if (auparse_first_record(au) <= 0) return;
        printf("event: %d\n", *event_cnt);
        printf("records:%d\n", auparse_get_num_records(au));
        do {
            printf("fields:%d\n", auparse_get_num_fields(au));
            printf("type=%d ", auparse_get_type(au));
            const au_event_t *e = auparse_get_timestamp(au);
            if (e == NULL) return;
            printf("event time: %lu.%u:%lu\n",
                    (long unsigned)e->sec, e->milli, e->serial);
            auparse_first_field(au);
            do {
                printf("%s=%s (%s)\n", auparse_get_field_name(au),
                       auparse_get_field_str(au),
                       auparse_interpret_field(au));
            } while (auparse_next_field(au) > 0);
            printf("\n");

        } while(auparse_next_record(au) > 0);
        (*event_cnt)++;
    }
}

main(int argc, char **argv)
{
    char *filename = argv[1];
    FILE *fp;
    char buf[256];
    size_t len;
    int *event_cnt = malloc(sizeof(int));

    au = auparse_init(AUSOURCE_FEED, 0);
    auparse_set_eoe_timeout(2);

    *event_cnt = 1;
    auparse_add_callback(au, auparse_callback, event_cnt, free);

    if ((fp = fopen(filename, "r")) == NULL) {
        fprintf(stderr, "could not open '%s', %s\n", filename, strerror(errno));
        return 1;
    }

    while ((len = fread(buf, 1, sizeof(buf), fp))) {
        auparse_feed(au, buf, len);
    }
    auparse_flush_feed(au);
    auparse_destroy(au);
}

---

👑 SEE ALSO 👑

Go read these next, they're all in the same friend group:

• auparse_add_callback(3)
• auparse_flush_feed(3)
• auparse_feed_age_events(3)
• auparse_feed_has_data(3)
• auparse_metrics(3)

---

💜 AUTHOR 💜

John Dennis — the icon, the moment, the legend 🫶

---

And that's the whole page, bestie — brought to you by the Linux Audit API, Red Hat, and a date stamp of Sept 2023, filed under AUPARSE_FEED(3). Now go feed that parser. Slay. ✨💖🎀🦋🌸💅