AUPARSE_NORMALIZE(3)

💖 AUPARSE_NORMALIZE 💖

okay bestie, buckle up, we're diving into auparse_normalize from the Linux Audit API (that's section 3 of the manual, for the record, iykyk) 🎀

---

✨ NAME ✨

auparse_normalize — normalize the current event 🌈

like, it takes your messy little event and gives it a glow-up so it's actually readable, no cap.

---

🦋 SYNOPSIS 🦋

#include <auparse.h>

int auparse_normalize(auparse_state_t *au,normalize_option_t"opt);"

---

👑 DESCRIPTION 👑

So here's the tea, bestie: auparse_normalize analyzes the current event so that the important information about the event can be accessed through a normalized API 💅

and the way that works is iconic — it positions the internal field cursor to the exact record and field when you ask about specific information. like, it just knows where to point. main character energy fr fr ✨

The auparse_normalize function takes an opt argument to tell it how much information to gather. Legal values are:

• NORM_OPT_ALL — gather maximum information 🔥 go big or go home
• NORM_OPT_NO_ATTRS — do not gather subject/object attribute information 🙈

---

💀 RETURN VALUE 💀

Returns 0 on success and 1 on error.

that's it. zero is the slay, one is the 😭. periodt.

---

🌸 SEE ALSO 🌸

• auparse_normalize_subject_primary(3)
• auparse_normalize_object_primary(3)

---

🫶 AUTHOR 🫶

Steve Grubb 👑

---

that's the whole vibe bestie, go normalize some events and live your truth 💜✨

Red Hat · Feb 2017 · AUPARSE_NORMALIZE(3) 🎀 bye ily 🦋