AUSEARCH_ADD_EXPRESSION(3)

💖 ausearch_add_expression(3) 💖

okay bestie, welcome to the Linux Audit API corner of the internet, this one is literally called ausearch_add_expression and it's about to be your new fave 🫶

---

✨ NAME ✨

ausearch_add_expression — build up search expression 🧚

---

🌸 SYNOPSIS 🌸

#include <auparse.h>

int ausearch_add_expression(auparse_state_t *au, const char *expression, char **error, ausearch_rule_t how);"

yes the stray " at the end is in the original, we don't touch it, we respect the lore 💅

---

🦋 DESCRIPTION 🦋

okay so here's the tea: ausearch_add_item adds an expression to the current audit search expression. (yes, the page really says ausearch_add_item there even though we're all here for ausearch_add_expression — that's what it says, so that's what you get, no cap.) Once that's done, the search conditions can be used to scan logs, files, or buffers for something of interest. so basically you're setting up the vibe check that later decides what counts as a match 🔍✨

the expression parameter contains an expression, as specified in ausearch-expression(5) — go read that one too, iykyk.

the how parameter determines how this search expression will affect the existing search expression, if one is already defined. the possible values are, and bestie, listen closely:

• AUSEARCH_RULE_CLEAR — clear the current search expression, if any, and use only this search expression. it's giving fresh start, clean slate, main character energy ✨
• AUSEARCH_RULE_OR — if a search expression E is already configured, replace it by (E || this_search_expression). so it's the "or" girlie, either one works, we're flexible 🎀
• AUSEARCH_RULE_AND — if a search expression E is already configured, replace it by (E && this_search_expression). and this one is the "and" girlie, both conditions gotta hit, no exceptions 💀

the caller must free the error message using free(3). not optional, not a suggestion, that's your homework 📝

if an error message is not available or can not be allocated, *error is set to NULL.

---

👑 SEE ALSO 👑

go read these too, they're all part of the friend group fr fr:

• ausearch_add_item(3)
• ausearch_add_interpreted_item(3)
• ausearch_add_timestamp_item(3)
• ausearch_add_regex(3)
• ausearch_set_stop(3)
• ausearch_clear(3)
• ausearch_next_event(3)
• ausearch_cur_event(3)
• ausearch-expression(5)

---

💜 AUTHOR 💜

Miloslav Trmac — thank you king 👑

---

and that's the whole page bestie!! this lil gem is from Red Hat, dated Feb 2008 — vintage but still eating, we love to see it 💖✨🎀🦋🌸💅🫶