AUPARSE_INIT(3)

💖 AUPARSE_INIT(3) — Linux Audit API 💖

okay bestie, gather round, because this one is the starting point of the whole audit-parsing saga. This is the manual page for auparse_init, from the Linux Audit API section 3, and yes, it's the one you call first before literally anything else works. ✨

---

✨ NAME ✨

auparse_init — initialize an instance of the audit parsing library 🎀

---

🌸 SYNOPSIS 🌸

#include <auparse.h>

auparse_state_t * auparse_init(ausource_tsource,constvoid*"b);"

(yeah that's literally how it's written in the source page, we do not editorialize, we copy exactly 💅)

---

🦋 DESCRIPTION 🦋

auparse_init initializes an instance of the audit parsing library. That's it, that's the whole job, and it's iconic for it.

The function returns an opaque pointer to the parser's internal state. You then hand that pointer into subsequent calls to the library, so keep it somewhere safe, bestie — losing it is giving "lost my keys at 3am" energy 😭.

The source variable decides where the library looks for data. Legal values can be:

• AUSOURCE_LOGS — use audit logs 📜
• AUSOURCE_FILE — use a file 📁
• AUSOURCE_FILE_ARRAY — use several files 🗂️
• AUSOURCE_BUFFER — use a buffer 🧺
• AUSOURCE_BUFFER_ARRAY — use an array of buffers 🧺🧺
• AUSOURCE_DESCRIPTOR — use a particular descriptor 🔌
• AUSOURCE_FILE_POINTER — use a stdio FILE pointer 🖇️
• AUSOURCE_FEED — feed data to parser with auparse_feed() 🌊

The pointer b is used to set the file name, array of filenames, the buffer address, or an array of pointers to buffers, or the descriptor number — depending on what source you gave it. So like, b is doing a lot of jobs, it's the main character fr fr 👑.

When the data source is an array of files or buffers, you would create an array of pointers with the last one being a NULL pointer. That NULL is your little "and that's the end bestie" flag. 🛑

Buffers should be NUL terminated. no cap, do not skip this one.

The data structure returned by auparse_init is not thread-safe. If you need to use it in a multithreaded program, you will need to add locking around any use of the data structure. That's not a suggestion, that's the vibe check, and it will not pass without locks 💀

---

⭐ RETURN VALUE ⭐

Returns a NULL pointer if an error occurs; otherwise, the return value is an opaque pointer to the parser's internal state. So: NULL = bad news 🙈, anything else = slay, you're in business 💅

---

🌈 SEE ALSO 🌈

• auparse_reset(3)
• auparse_destroy(3)
• auparse_feed(3)

---

💜 AUTHOR 💜

Steve Grubb 👑

---

Red Hat, Jan 2023 — and that's the whole page, bestie! go forth, init your parser, and remember: no locks, no peace 🫶💖✨