📦 audit-libs-devel

104 pages

A

audit_add_rule_data(3)Add new audit rule✨
audit_add_watch(3)create a rule layout for a watch✨
audit_can_read(3)test audit related capabilities✨
audit_close(3)Close the audit netlink socket connection✨
audit_delete_rule_data(3)Delete audit rule✨
audit_detect_machine(3)Detects the current machine type✨
audit_encode_nv_string(3)encode a name/value pair in a string✨
audit_encode_value(3)encode bytes as an ASCII hexadecimal string✨
audit_flag_to_name(3)Convert the numeric rule-matching filter value to the rule-matching filter name✨
audit_fstype_to_name(3)Convert the numeric fstype value to the fstype name✨
audit_get_features(3)query or change kernel audit features✨
audit_get_reply(3)Get the audit system's reply✨
audit_get_session(3)Get a program's login session id value✨
audit_getloginuid(3)Get a program's loginuid value✨
audit_is_enabled(3)judge whether auditing is enabled or not✨
audit_log_acct_message(3)log a user account message✨
audit_log_semanage_message(3)log a semanage message✨
audit_log_user_avc_message(3)log a user avc message✨
audit_log_user_comm_message(3)log a user message from a console app✨
audit_log_user_command(3)log a user command✨
audit_log_user_message(3)log a general user message✨
audit_name_to_action(3)Convert the action name to the numeric action value to each other✨
audit_name_to_errno(3)Convert the errno name and the numeric errno value to each other✨
audit_name_to_flag(3)Convert the rule-matching filter name to the numeric rule-matching filter value✨
audit_name_to_fstype(3)Convert the fstype name to the numeric fstype value✨
audit_name_to_syscall(3)Convert the syscall name to the numeric syscall value✨
audit_open(3)Open a audit netlink socket connection✨
audit_request_features(3)request audit feature bitmap✨
audit_request_rules_list_data(3)Request list of current audit rules✨
audit_request_signal_info(3)Request signal info for the audit system✨
audit_request_status(3)Request status of the audit system✨
audit_reset_backlog_wait_time_actual(3)reset backlog wait time actual counter✨
audit_reset_lost(3)reset lost event counter✨
audit_set_backlog_limit(3)Set the audit backlog limit✨
audit_set_backlog_wait_time(3)Set the audit backlog wait time✨
audit_set_enabled(3)Enable or disable auditing✨
audit_set_failure(3)Set audit failure flag✨
audit_set_feature(3)query or change kernel audit features✨
audit_set_loginuid_immutable(3)make loginuid value immutable✨
audit_set_pid(3)Set audit daemon process ID✨
audit_set_rate_limit(3)Set audit rate limit✨
audit_setloginuid(3)Set a program's loginuid value✨
audit_syscall_to_name(3)Convert the numeric syscall value to the syscall name✨
audit_update_watch_perms(3)update permissions field of watch command✨
audit_value_needs_encoding(3)check a string to see if it needs encoding✨
auparse_add_callback(3)add a callback handler for notifications✨
auparse_destroy(3)release instance of parser✨
auparse_feed(3)feed data into parser✨
auparse_feed_age_events(3)check events for complete based on time.✨
auparse_feed_has_data(3)check if there is any data accumulating that might need flushing.✨
auparse_find_field(3)search for field name✨
auparse_find_field_next(3)find next occurrence of field name✨
auparse_first_field(3)reposition field cursor✨
auparse_first_record(3)reposition record cursor✨
auparse_flush_feed(3)flush any unconsumed feed data through parser.✨
auparse_get_field_int(3)get current field's value as an int✨
auparse_get_field_name(3)get current field's name✨
auparse_get_field_num(3)get current field cursor location✨
auparse_get_field_str(3)get current field's value✨
auparse_get_field_type(3)get current field's data type✨
auparse_get_filename(3)get the filename where record was found✨
auparse_get_line_number(3)get line number where record was found✨
auparse_get_milli(3)get the millisecond value of the event✨
auparse_get_node(3)get the event's machine node name✨
auparse_get_num_fields(3)get the number of fields✨
auparse_get_num_records(3)get the number of records✨
auparse_get_record_num(3)get current record cursor location✨
auparse_get_record_text(3)access unparsed record data✨
auparse_get_serial(3)get the event's serial number✨
auparse_get_time(3)get event's time✨
auparse_get_timestamp(3)access timestamp of the event✨
auparse_get_type(3)get record's type✨
auparse_get_type_name(3)get record's type translation✨
auparse_goto_field_num(3)move field cursor to specific field✨
auparse_goto_record_num(3)move record cursor to specific record✨
auparse_init(3)initialize an instance of the audit parsing library✨
auparse_interpret_field(3)get current field's interpreted value✨
auparse_metrics(3)get some metrics about auparse✨
auparse_new_buffer(3)replace the buffer in the parser✨
auparse_next_event(3)get the next event✨
auparse_next_field(3)move field cursor✨
auparse_next_record(3)move record cursor✨
auparse_node_compare(3)compares node name values✨
auparse_normalize(3)normalize the current event✨
auparse_normalize_functions(3)Access normalized fields✨
auparse_reset(3)reset audit parser instance✨
auparse_set_eoe_timeout(3)set the end of event timeout value✨
auparse_set_escape_mode(3)choose escape method✨
auparse_timestamp_compare(3)compares timestamp values✨
auplugin(3)plugin event processing helpers✨
auplugin_fgets(3)buffered line reader helpers✨
ausearch-expression(5)audit search expression format✨
ausearch_add_expression(3)build up search expression✨
ausearch_add_interpreted_item(3)build up search rule✨
ausearch_add_item(3)build up search rule✨
ausearch_add_regex(3)use regular expression search rule✨
ausearch_add_timestamp_item(3)build up search rule✨
ausearch_add_timestamp_item_ex(3)build up search rule✨
ausearch_clear(3)clear search parameters✨
ausearch_cur_event(3)check if the current event meets search criteria✨
ausearch_next_event(3)find the next event that meets search criteria✨
ausearch_set_stop(3)set the cursor position✨

G

get_auditfail_action(3)Get failure_action tunable value✨

S

set_aumessage_mode(3)Sets the message mode✨