AUSEARCH_ADD_TIMESTAMP_ITEM(3)

💖 AUSEARCH_ADD_TIMESTAMP_ITEM(3) 💖

okay bestie, welcome to the Linux Audit API corner of the group chat ✨ this one's ausearch_add_timestamp_item, and she's literally the moment you want to build a search rule based on when stuff happened 🕰️

---

🌸 NAME 🌸

ausearch_add_timestamp_item — build up search rule 🫶

---

✨ SYNOPSIS ✨

#include <auparse.h>

int ausearch_add_timestamp_item(auparse_state_t *au, const char *op, time_t sec,
                                unsigned milli, ausearch_rule_t how);

---

🦋 DESCRIPTION 🦋

so ausearch_add_timestamp_item adds an event time condition to the current audit search expression, no biggie 💅 and like — once you've got your search conditions stacked up, you can use them to scan logs, files, or buffers for something of interest 👀 iconic behaviour honestly.

the op parameter is the vibe check on the comparison — it says which comparison you want. the legal op values are:

• <
• <=
• >=
• >
• =

and just so we're clear on the math, bestie: the left operand of the comparison operator is the timestamp of the examined event, and the right operand is whatever you passed in through the sec and milli parameters. that's the whole setup 🎀

now, the how value is the one that decides how this search condition is gonna affect the search expression you've already got going, if one's already defined. the possible values are:

• AUSEARCH_RULE_CLEAR — clears the current search expression, if any, and uses only this search condition. like a clean slate, periodt 🧹
• AUSEARCH_RULE_OR — if a search expression E is already configured, it gets replaced by (E || this_search_condition). two vibes, either one works 🌈
• AUSEARCH_RULE_AND — if a search expression E is already configured, it gets replaced by (E && this_search_condition). both or nothing, no cap 🔥

---

💫 RETURN VALUE 💫

returns -1 if an error occurs; otherwise, 0 for success. that's it, that's the whole story 💀

---

👑 APPLICATION USAGE 👑

use ausearch_add_item(3) and ausearch_add_interpreted_item(3) when you wanna add conditions that check audit record fields instead. and use ausearch_add_expression(3) if you wanna add complex search expressions in one single function call — one call, whole fit, slay 💅

---

🎀 SEE ALSO 🎀

• ausearch_add_expression(3)
• ausearch_add_item(3)
• ausearch_add_interpreted_item(3)
• ausearch_add_regex(3)
• ausearch_set_stop(3)
• ausearch_clear(3)
• ausearch_next_event(3)
• ausearch_cur_event(3)
• ausearch-expression(5)

---

💜 AUTHOR 💜

Miloslav Trmac 🫶

---

and that's a wrap, bestie!! this little masterpiece came to you courtesy of Red Hat, back in Aug 2014, and yes she's still serving under the name AUSEARCH_ADD_TIMESTAMP_ITEM(3) 🌟 go forth and timestamp responsibly, ily 💖✨