AUSEARCH_ADD_ITEM(3)

💖 AUSEARCH_ADD_ITEM(3) — Linux Audit API 💖

okay bestie, so this one's from the Linux Audit API family, manual section 3, and it's literally the function that lets you build up a search rule, one lil condition at a time. iconic behavior honestly 🎀

---

✨ NAME ✨

ausearch_add_item — build up search rule 🦋

---

🌸 SYNOPSIS 🌸

#include <auparse.h>

int ausearch_add_item(auparse_state_t *au, const char *field, const char *op, const char *value, ausearch_rule_t how);

---

💅 DESCRIPTION 💅

so ausearch_add_item adds one search condition to the current audit search expression. that's it, that's the job. then once you've stacked up your conditions, you can use them to scan logs, files, or buffers for something of interest. main character energy fr fr ✨

the field value is the field name that the value is gonna get checked for. like, what are we even looking at here.

the op variable describes what kind of check is to be done. the legal op values are:

• exists — just check that a field name exists. that's all, no value drama, we're just vibing and confirming it's there 👑
• = — locate the field name and check that the value associated with it is equal to the value given in this rule. matchy matchy 💖
• != — locate the field name and check that the value associated with it is NOT equal to the value given in this rule. respectfully, we do not want it 🙈

---

the value parameter is compared to the uninterpreted field value. so heads up: if you're trying to match against a field whose type is AUPARSE_TYPE_ESCAPED, you will want to use the ausearch_add_interpreted_item() function instead. not me giving you the right tool for the right job 🫶

the how value determines how this search condition will affect the existing search expression if one is already defined. the possible values are:

• AUSEARCH_RULE_CLEAR — clear the current search expression, if any, and use only this search condition. fresh start, clean slate, no baggage ✨
• AUSEARCH_RULE_OR — if a search expression E is already configured, replace it by (E || this_search_condition). either/or, we're flexible like that 🌈
• AUSEARCH_RULE_AND — if a search expression E is already configured, replace it by (E && this_search_condition). both. it has to be both. no negotiation 🔥

---

🎀 RETURN VALUE 🎀

returns -1 if an error occurs; otherwise, 0 for success. so like, -1 is giving 💀 and 0 is giving 💖.

---

🦋 SEE ALSO 🦋

• ausearch_add_expression(3)
• ausearch_add_interpreted_item(3)
• ausearch_add_timestamp_item(3)
• ausearch_add_regex(3)
• ausearch_set_stop(3)
• ausearch_clear(3)
• ausearch_next_event(3)
• ausearch_cur_event(3)
• ausearch-expression(5)

---

👑 AUTHOR 👑

Steve Grubb

---

okay that's the whole page bestie, slay 💅 this one's Red Hat, dated Feb 2012, and it lives at AUSEARCH_ADD_ITEM(3) in the Linux Audit API section — go forth and build those search rules, periodt 🌸🦋💜