AU_EVENT(3)

okay bestie, buckle up — this is AU_EVENT(3) from the Library Functions Manual, and it's literally the whole cheat sheet for looking stuff up in the audit event database ✨ no cap, it's more fun than it sounds 💅

---

🌸 NAME 🌸

free_au_event_ent, setauevent, endauevent, getauevent, getauevent_r, getauevnam, getauevnam_r, getauevnum, getauevnum_r, getauevnonam, getauevnonam_r — the girlies that look up information from the audit_event(5) database 🎀

---

🦋 LIBRARY 🦋

Basic Security Module Library (libbsm, -lbsm) — yeah, link it, she's iconic 💜

---

✨ SYNOPSIS ✨

#include <bsm/libbsm.h>

void
setauevent(void);

void
endauevent(void);

struct au_event_ent *
getauevent(void);

struct au_event_ent *
getauevent_r(struct au_event_ent *e);

struct au_event_ent *
getauevnam(const char *name);

struct au_event_ent *
getauevnam_r(struct au_event_ent *e, const char *name);

struct au_event_ent *
getauevnum(au_event_t event_number);

struct au_event_ent *
getauevnum_r(struct au_event_ent *e, au_event_t event_number);

au_event_t *
getauevnonam(const char *event_name);

au_event_t *
getauevnonam_r(au_event_t *ev, const char *event_name);

---

💖 DESCRIPTION 💖

so these interfaces are your little squad for pulling info out of the audit_event(5) database, which is the whole catalog of audit events 📚. Every entry in that database is described by a struct au_event_ent, and you get one back from getauevent(), getauevnam(), or getauevnum(). You can also go the other way and look up an event number using getauevnonam() — she's the reverse-lookup queen 👑

• setauevent() — resets the database access session for audit_event(5) 💫 so the next getauevent() call starts all the way back at the first entry in the database. fresh start energy, we love her.
• endauevent() — closes the audit_event(5) database session. say bye bestie 👋
• getauevent() — hands you a reference to the next entry in the audit_event(5) database. she walks forward, that's her thing 🚶‍♀️
• getauevnam() — returns a reference to the entry in the audit_event(5) database whose name is name. name-based slay 💅
• getauevnum() — returns a reference to the entry in the audit_event(5) database whose event number is event_number. numbers are valid too, we don't discriminate 🔢
• getauevnonam() — returns a reference to an audit event number, using the audit_event(5) database. this is the "I know her name, give me her digits" function 😭

also lowkey there's free_au_event_ent up in the NAME section — she's family, she's part of the crew 💜

---

🫶 RETURN VALUES 🫶

getauevent(), getauevent_r(), getauevnam(), getauevnam_r(), getauevnum(), getauevnum_r(), and getauevnonam() will return a reference to a struct au_event_ent or au_event_t on success ✅, or NULL on failure 💀 — and errno gets set to give you the further error info (mostly, see BUGS below, she's a little flaky 🙈).

---

🔥 SEE ALSO 🔥

• libbsm(3)
• audit_event(5)

iykyk, go read those next 🧚

---

⭐ HISTORY ⭐

the OpenBSM implementation was created by McAfee Research, the security division of McAfee Inc., under contract to Apple Computer, Inc., in 2004 🍎. It was subsequently adopted by the TrustedBSD Project as the foundation for the OpenBSM distribution. main character origin story fr fr 👑

---

💜 AUTHORS 💜

This software was created by Robert Watson, Wayne Salamon, and Suresh Krishnaswamy for McAfee Research, the security research division of McAfee, Inc., under contract to Apple Computer, Inc. 👏

The Basic Security Module (BSM) interface to audit records and audit event stream format were defined by Sun Microsystems. icons only 🌈

---

💀 BUGS 💀

• The errno variable is not always properly set following a failure 😭 so like... don't fully trust her to tell you what went wrong.
• These routines are thread-safe, but not re-entrant, so simultaneous or interleaved use of these functions will affect the iterator ⚠️ fr fr, share the iterator with care or she gets confused.

---

okay that's the whole page, bestie 🎀 this was Debian, dated April 19, 2005 — vintage but still serving ⭐💅🦋