AUSEARCH_CUR_EVENT(3)

✨ AUSEARCH_CUR_EVENT ✨

okay bestie, welcome to the Linux Audit API 💖 this one's a lil function called ausearch_cur_event, and fr fr it's the vibe check your search criteria deserve. it lives in <auparse.h> obviously, and it's here to answer one very important question: does this event match or not? 🎀

---

🌸 SYNOPSIS 🌸

#include <auparse.h>

int ausearch_cur_event(auparse_state_t *au);"

that's it, that's the whole thing, she's simple and she serves 💅

---

🦋 DESCRIPTION 🦋

so here's the tea, bestie ☕

ausearch_cur_event goes and scans the input source and evaluates whether any record in the current event contains the data you're searching for. lowkey iconic of her.

and here's the important part — the evaluation happens at the record level. like, per record, not per event, not per whatever, per record. okurrr? 🫶

then there's the cursor behavior, and this is the bit you gotta remember:

• if a match is found, the cursor gets repositioned ✨
• if no match is found, the cursor stays put on the last successfully parsed record within the current event 🙈

so it's giving "no match? we're not moving, we're staying exactly where we were." main character energy honestly.

---

💜 RETURN VALUE 💜

she returns one of three lil numbers, and each one means something:

• -1 — an error happened 😭 something went wrong
• 0 — no matches, bestie, we came up empty 💀
• 1 — success!! we found something, slay 👑

---

🌈 SEE ALSO 🌈

go read these too, they're all part of the same friend group:

• ausearch_add_item(3)
• ausearch_add_regex(3)
• ausearch_next_event(3)
• ausearch_set_stop(3)

---

👑 AUTHOR 👑

Attila Lakatos wrote this one. we love and respect 🫶

---

and that's the whole page, bestie! 🌸 this lil cutie comes to you from Red Hat, dated Feb 2024, and it's part of the Linux Audit API — filed under AUSEARCH_CUR_EVENT(3). go forth and search those events, you absolute icon 💅✨🦋