AUPARSE_NORMALIZE_FUNCTIONS(3)

✨ AUPARSE_NORMALIZE_FUNCTIONS ✨

okay bestie, welcome to the Linux Audit API, auparse_normalize_functions edition 💖 this is the part of the manual (section 3, for all my library-function girlies) where you get to access normalized fields after the normalization already did its thing. so you ran the normalizer, now what? now you read the tea. 🍵

---

🌸 NAME 🌸

auparse_normalize_get_event_kind, auparse_normalize_subject_kind, auparse_normalize_get_action, auparse_normalize_object_kind, auparse_normalize_how, auparse_normalize_session, auparse_normalize_subject_primary, auparse_normalize_subject_secondary, auparse_normalize_subject_first_attribute, auparse_normalize_subject_next_attribute, auparse_normalize_object_primary, auparse_normalize_object_secondary, auparse_normalize_object_primary2, auparse_normalize_object_first_attribute, auparse_normalize_object_next_attribute, auparse_normalize_get_results, auparse_normalize_key — Access normalized fields 👑

---

🦋 SYNOPSIS 🦋

#include <auparse.h>

💜 Metadata Functions (the "just tell me stuff" squad)

const char *auparse_normalize_get_event_kind(const auparse_state_t *au);
const char *auparse_normalize_subject_kind(const auparse_state_t *au);
const char *auparse_normalize_get_action(const auparse_state_t *au);
const char *auparse_normalize_object_kind(const auparse_state_t *au);
const char *auparse_normalize_how(const auparse_state_t *au);

💅 Positioning Functions (the "move the cursor for me" squad)

int auparse_normalize_session(auparse_state_t *au);
int auparse_normalize_subject_primary(auparse_state_t *au);
int auparse_normalize_subject_secondary(auparse_state_t *au);
int auparse_normalize_subject_first_attribute(auparse_state_t *au);
int auparse_normalize_subject_next_attribute(auparse_state_t *au);
int auparse_normalize_object_primary(auparse_state_t *au);
int auparse_normalize_object_secondary(auparse_state_t *au);
int auparse_normalize_object_primary2(auparse_state_t *au);
int auparse_normalize_object_first_attribute(auparse_state_t *au);
int auparse_normalize_object_next_attribute(auparse_state_t *au);
int auparse_normalize_get_results(auparse_state_t *au);
int auparse_normalize_key(auparse_state_t *au);

---

🎀 DESCRIPTION 🎀

so here's the vibe: after you call the auparse_normalize function, you're obviously gonna want to actually get at the audit event data, right? like, the normalizing happened, the data is sitting there being all normalized, and you're just supposed to... not look at it? no bestie. 💀

these functions are literally the access point to the results of the normalization. and there are 2 kinds of them, so pay attention:

• metadata functions 🧚
• positioning functions 🎯

✨ the metadata girlies ✨

the metadata functions all return a pointer to a string that describes something about the event. plot twist: this data does not live inside the event itself — it's kept in lookup tables inside the auparse library. so it's giving "the event's whole personality lives in a table somewhere else". 🌈

🔥 the positioning girlies 🔥

the positioning functions are built different. they move the internal cursor of auparse to the record and field that contains the info you want. so then you use field accessor functions to retrieve the actual values. it's a two-step, and honestly? iconic. 👑

---

💖 RETURN VALUE 💖

• the positioning functions return < 0 on error, 0 if uninitialized, and 1 on success. (three moods fr fr)
• the metadata functions return NULL on error and a pointer to a string on success.

---

🌟 SEE ALSO 🌟

• auparse_normalize(3)
• auparse_get_field_str(3)
• auparse_interpret_field(3)

---

👑 AUTHOR 👑

Steve Grubb — yes, the legend himself. we stan. 🫶

---

okay that's the whole page, you ate that, now go normalize some events bestie 💅 ✨

this has been the Linux Audit API, brought to you by Red Hat, dated March 2017 — mwah, love u, bye 💖🎀🦋