AUPARSE_FIRST_RECORD(3)

💖 AUPARSE_FIRST_RECORD(3) 💖

the Linux Audit API ✨ (3) — yes bestie, section 3, library functions, we're in that part of the manual 🎀

---

✨ NAME ✨

auparse_first_record — reposition record cursor 🦋

okay so literally the whole job is: move the little pointer thingy. that's it. that's the gig. 👑

---

✨ SYNOPSIS ✨

#include <auparse.h>

int auparse_first_record(auparse_state_t *au);"

yes you need the header, yes the function takes one arg, no you cannot skip this part 🙈

---

✨ DESCRIPTION ✨

okay so auparse_first_record does the cutest little thing: it repositions the internal cursors of the parsing library so they point at the first field of the first record in the current event. 💅

like… you were somewhere in the middle of the event, vibing, scrolling through records, and this function just goes rewind and puts you right back at the very start. main character energy fr fr. 🌸

three things it's pointing you at, and you need all three, no skipping:

• the first field 🍓
• of the first record 🍓
• in the current event 🍓

not the first event, bestie. the current one. don't get it twisted. 😭

---

✨ RETURN VALUE ✨

the receipts, because we always check the receipts 🧚

• -1 — an error happened, something went wrong, it's giving chaos 💀
• 0 — there's no event data to work with, like an empty group chat 🫶
• 1 — success!! we ate, no crumbs, periodt ✨

---

✨ SEE ALSO ✨

your little reading list, go be nosy 👀

• auparse_next_event(3)
• auparse_next_record(3)

---

✨ AUTHOR ✨

Steve Grubb — thank you for your service king 🫡💜

---

reminder bestie: this page is the Linux Audit API, section 3, and it's brought to you by Red Hat, dated Sep 2014. oldie but a goodie, still iconic, still slaying. 🌈⭐

now go rewind that cursor and have the best day ever 💖🎀🦋