AUPARSE_NEXT_FIELD(3)

💖 AUPARSE_NEXT_FIELD 💖

okay bestie, welcome to section 3 of the Linux Audit API — this one's auparse_next_field, and it's honestly a lil baby function with main character energy. sit down, grab a boba, let's go 🧋✨

---

✨ NAME ✨

auparse_next_field — move the field cursor 🎯

🦋 SYNOPSIS 🦋

#include <auparse.h>

int auparse_next_field(const auparse_state_t *au);"

(yes, that trailing quote is literally in the original, i'm not touching it, periodt 💅)

🌸 DESCRIPTION 🌸

so. the library has this internal cursor, right? like a little arrow pointing at stuff 👉 and auparse_next_field makes it hop forward to the next field in the current record of the current event.

that's it. that's the whole job. it's giving "next slide please" 💀

think of it like scrolling your for you page, but instead of videos it's audit fields, and instead of the algorithm it's you, manually, one at a time. no cap. 🌈

👑 RETURN VALUE 👑

• 0 — no more fields exist, we're done here, the field cursor has hit the end of the road 🛑😭
• 1 — success!! it worked, slay 💖✨

ngl, 0 meaning "no more" and 1 meaning "yes more" is lowkey iconic in a confusing way, but that's just how it is. check it, don't guess. 🔍

🎀 SEE ALSO 🎀

• auparse_next_record(3) — the sibling function, the one that moves the record cursor instead of the field cursor. yin and yang fr fr 🫶

💜 AUTHOR 💜

Steve Grubb

---

and that's the whole page bestie!! 🦋 this lil gem came to you from Red Hat, dated Feb 2007 — yes, 2007, it's vintage, it's an elder icon, we respect our elders in this house 👑🌸

now go forth and move that cursor. i believe in you. mwah 💅💖