AUSEARCH_ADD_REGEX(3)

✨ AUSEARCH_ADD_REGEX ✨

okay bestie, welcome to ausearch_add_regex — it's a Linux Audit API moment, manual section 3, and it's literally the girl who matches regex against your audit records. let's get into it 💅

---

🌸 NAME 🌸

ausearch_add_regex — use regular expression search rule 🎀

---

🦋 SYNOPSIS 🦋

#include <auparse.h>

int ausearch_add_regex(auparse_state_t *au,constchar*"regexp);"

no bc why is that signature like that 😭 it's giving unhinged but we're keeping it exactly as it is, no cap. copy it verbatim or perish.

---

💖 DESCRIPTION 💖

so what does this icon actually <em>do</em>? ausearch_add_regex adds one search condition based on a regular expression to the current audit search expression. one. single. condition. main character energy, but only one. ✨

then those search conditions can be used to scan logs, files, or buffers for something of interest. slay.

the regular expression follows the posix extended regular expression conventions, and — listen closely bestie — it is matched against the full record, without interpreting field values. so it's the whole thing, raw, no field-by-field breakdown. periodt. 🫶

and here's the plot twist: if an existing search expression E is already defined, this function replaces it by (E && this_regexp). so it's not throwing your old expression away, it's gluing them together with an AND. obsessed. 🔥

---

👑 RETURN VALUE 👑

• -1 — returned if an error occurs 😭 it's not giving success
• 0 — returned for success ✨ we love to see it

---

🌈 SEE ALSO 🌈

• ausearch_add_expression(3)
• ausearch_add_item(3)
• ausearch_clear(3)
• ausearch_next_event(3)
• ausearch_cur_event(3)
• regcomp(3)

go read those too, iykyk 📚💜

---

🎀 AUTHOR 🎀

Steve Grubb 💫

---

ok that's the whole page bestie, you ate that. this was Red Hat, dated Sept 2007 — yes she's an elder but she still serves 💅🦋 bye pookie 🫶