AUPARSE_NEW_BUFFER(3)

💖 AUPARSE_NEW_BUFFER 💖

okay so bestie, this is the manual page for auparse_new_buffer from the Linux Audit API (that's the section 3 library page, iykyk) ✨

---

🌸 NAME 🌸

auparse_new_buffer — swap out the buffer the parser is working on, like trading out your phone case but for data 🎀

---

✨ SYNOPSIS ✨

#include <auparse.h>

int auparse_new_buffer(auparse_state_t *au, const char *data, size_t data_len);

And here's the tea on every single argument, no skipping, we're thorough in this house:

• au — the audit parse state, aka the main character of this whole operation 👑
• data — a buffer of data you're handing over to the parser. It's data_len bytes long. The data gets copied into the parser without modifying the original, so the second you get back you can free it or reuse it, do whatever, it's yours again 🦋
• data_len — literally just the number of bytes in data. that's it. that's the whole job 💅

---

💜 DESCRIPTION 💜

auparse_new_buffer replaces the data that the parser works on. it's giving "out with the old, in with the new" 🌈

⚠️ but hold up — auparse_init() must have been called with a source type of AUSOURCE_BUFFER first, or this whole vibe check fails. no cap.

---

🔥 RETURN VALUE 🔥

Returns 1 if an error occurs; otherwise, 0 for success.

so yeah, it's one of those functions where 0 is the slay outcome and 1 is the "we have a problem" outcome 😭 don't get it twisted.

---

👑 SEE ALSO 👑

auparse_init(3) — go read that one too, it's the prerequisite bestie, they're a package deal 🫶

---

Red Hat, June 2025 — mwah, that's the source, the version and the date, all wrapped up with a bow 🎀💖 bye bestie, go parse something iconic ✨