AUPARSE_FIRST_FIELD(3)

🌸 AUPARSE_FIRST_FIELD 💅

okay bestie, welcome to the Linux Audit API corner of the man pages — this one's the auparse_first_field(3) girlie, and she's here to reposition your field cursor ✨

✨ SYNOPSIS ✨

first things first, you gotta bring her in:

#include <auparse.h>

int auparse_first_field(const auparse_state_t *au);"

yes, that's the whole signature. she's lowkey simple like that 🫶

💖 DESCRIPTION 💖

so what does she actually do? auparse_first_field takes the library's internal cursor and, like, snaps it back to point at the first field of the current record in the current event. that's it. that's the whole vibe. she's the "rewind, bestie, we're starting over" button 🔁💖

🎀 RETURN VALUE 🎀

• 0 — there's no event data at all, nothing to see here 🙈
• 1 — success, we ate, cursor is placed 👑

🦋 SEE ALSO 🦋

• auparse_next_field(3) — the opposite-direction queen, when you're ready to move forward instead 💫

👑 AUTHOR 👑

Steve Grubb — thank you for your service, icon 🫡💜

mwah, that's the whole page bestie, no cap. this little love letter came to you from Red Hat, dated Feb 2007, and it's still serving looks in the Linux Audit API to this very day 🌈🎀💖