AUPARSE_INTERPRET_FIELD(3)

💖 auparse_interpret_field(3) 💖

okay bestie, sit down, hydrate, because we're about to talk about the <auparse.h> girlies that translate your raw audit fields into stuff a human can actually read. This is the auparse_interpret_field(3) family and honestly? iconic. 🎀

---

✨ NAME ✨

auparse_interpret_field, auparse_interpret_realpath, auparse_interpret_sock_family, auparse_interpret_sock_port, auparse_interpret_sock_address — get the current field's interpreted value 💅

---

🌸 SYNOPSIS 🌸

#include <auparse.h>

const char *auparse_interpret_field(const auparse_state_t *au);
const char *auparse_interpret_realpath(const auparse_state_t *au);
const char *auparse_interpret_sock_family(auparse_state_t *au);
const char *auparse_interpret_sock_port(auparse_state_t *au);
const char *auparse_interpret_sock_address(const auparse_state_t *au);

---

🦋 DESCRIPTION 🦋

So, auparse_interpret_field gives you the interpreted value of the field you're currently sitting on — that's the current field of the current record of the current event, no cap. The string it hands back is escaped using whichever escape method you picked. 🫶

⚠️ and this part MATTERS: the returned string gets destroyed if you call this function again. it's giving "one (1) use only". if you need to interpret another field and keep this value, you have to copy it for later. do not skip this step, bestie, I am begging. 😭

Things that might get interpreted include: uid, gid, syscall numbers, exit codes, file paths, socket addresses, permissions, modes, and capabilities. And there are likely to be more in the future — the glow-up never ends ✨. If a value can't be interpreted, you just get its original value back. no drama.

auparse_interpret_realpath is literally auparse_interpret_field but it also calls realpath on the result of gluing the cwd and file together. Which also means it's only valid to call for the file name given in a PATH record. read that twice. 📌

auparse_interpret_sock_family returns only the socket family portion of a socket address. just the family. that's the whole job. 💅

auparse_interpret_sock_port returns only the port portion of a socket address. but lowkey not all socket families even have a port — if yours doesn't, you get a NULL value, and in that case your best option is to use the normal interpretation function. 🎀

auparse_interpret_sock_address returns only the address portion of a socket address. same situation: not all socket families have an ip address, and if yours doesn't, you get a NULL value, and your best option is (you guessed it) the normal interpretation function. 🌈

---

👑 RETURN VALUE 👑

Returns NULL if there's an error. Otherwise, a pointer to the interpreted value. that's it, that's the deal. ⭐

---

🔥 SEE ALSO 🔥

• auparse_get_field_int(3)
• auparse_get_field_str(3)
• auparse_set_escape_mode(3)

---

💜 AUTHOR 💜

Steve Grubb

---

and that's the whole page, bestie — written under Red Hat, dated August 2017, and I love that for us. go forth and interpret your fields responsibly. mwah 💋✨