AUSEARCH_ADD...TAMP_ITEM_EX(3)

✨ AUSEARCH_ADD_TIMESTAMP_ITEM_EX ✨

okay bestie, so this one lives in the Linux Audit API section of the manual (section 3, the library-functions girlies 💅), and it's literally the function that builds up a search rule. buckle up, it's short but it slaps 🎀

---

🌸 NAME 🌸

ausearch_add_timestamp_item_ex — build up search rule 🫶

---

🌈 SYNOPSIS 🌈

#include <auparse.h>

int ausearch_add_timestamp_item_ex(auparse_state_t *au,
                                    const char *op,
                                    time_t sec,
                                    unsigned milli,
                                    unsigned serial,
                                    ausearch_rule_t how);

---

💖 DESCRIPTION 💖

ausearch_add_timestamp_item adds an event time condition to the current audit search expression. periodt. once you've got your search conditions stacked up, you can use them to scan logs, files, or buffers for something of interest ✨

so the op parameter is the vibe-check of the comparison — it specifies the desired comparison. legal op values are <, <=, >=, > and = — that's it, those are the only ones, no cap.

the left operand of the comparison operator is the timestamp of the examined event 👀 and the right operand is specified by the sec, milli, and serial parameters. so like, event timestamp on the left, your custom timestamp on the right, and op is the little guy in the middle deciding who wins 🧚

now the how value determines how this search condition will affect the existing search expression if one is already defined. the possible values are:

• AUSEARCH_RULE_CLEAR — clear the current search expression, if any, and use only this search condition. it's giving clean slate energy 🧹✨
• AUSEARCH_RULE_OR — if a search expression E is already configured, replace it by (E || this_search_condition).
• AUSEARCH_RULE_AND — if a search expression E is already configured, replace it by (E && this_search_condition).

ngl those || and && are doing the absolute most in this economy and we love them for it 🔥

---

😭 RETURN VALUE 😭

Returns -1 if an error occurs; otherwise, 0 for success.

so like… 0 = slay, -1 = not slay 💀 that's the whole vibe check.

---

👑 APPLICATION USAGE 👑

use ausearch_add_item(3) and ausearch_add_interpreted_item(3) to add conditions that check audit record fields. use ausearch_add_expression(3) to add complex search expressions using a single function call. iykyk 🫶

---

🦋 SEE ALSO 🦋

• ausearch_add_expression(3)
• ausearch_add_item(3)
• ausearch_add_interpreted_item(3)
• ausearch_add_regex(3)
• ausearch_set_stop(3)
• ausearch_clear(3)
• ausearch_next_event(3)
• ausearch_cur_event(3)
• ausearch-expression(5)

---

🍓 AUTHOR 🍓

Miloslav Trmac — icon, legend, the moment 💜

---

and that's the whole page bestie, no crumbs left 🌸 this one came from Red Hat, dated Aug 2014, and the manual name is AUSEARCH_ADD...TAMP_ITEM_EX(3) — she's giving abbreviated-section-title realness and honestly? she ate. mwah 💅✨