AUPARSE_FIND_FIELD(3)

✨ AUPARSE_FIND_FIELD(3) ✨

okay bestie so this one lives in the Linux Audit API section of the manual (section 3, the library-calls girlies 💅), and it's literally the search bar of your audit event. let's get into it 🫶

---

🌸 NAME 🌸

auparse_find_field — search for field name

---

🎀 SYNOPSIS 🎀

#include <auparse.h>

const char * auparse_find_field(auparse_state_t *au,constchar*"name);"

(no i did not typo that, that's literally what the synopsis says, i am but a humble messenger 🙈)

---

💖 DESCRIPTION 💖

so auparse_find_field goes on a lil scavenger hunt 🔍 — it scans all the records in an event to find the first occurrence of the field name you hand it.

the search starts from wherever the cursor is currently sitting, so it's not a "start from the top every time" situation, it's a "from here, onward" situation. main character energy honestly.

and the field name you pass in? it gets stored for subsequent searching. so it remembers what you were looking for. it's thoughtful like that 💜

NOTE: auparse creates 2 pseudo fields that do not exist in the natural record for SELinux AVC and USER_AVC decision and permissions. their names are seresult and seperms respectively. so if you're like "where did this field come from??" — it's a pseudo field, it's fine, breathe 🧚

---

👑 RETURN VALUE 👑

• returns NULL if the field was not found 😭
• if an error occurs, errno will be set
• otherwise? it returns a pointer to the text value associated with the field. slay ✨

---

🌈 SEE ALSO 🌈

• auparse_first_record(3)
• auparse_find_field_next(3)

go read those too, they're the rest of the friend group 🦋

---

💜 AUTHOR 💜

Steve Grubb 👑

---

and that's the whole vibe check 🎀 this page is brought to you by Red Hat, dated June 2021. stan the audit API, periodt 💅✨