1AUPARSE_FEED(3)                 Linux Audit API                AUPARSE_FEED(3)
2
3
4

NAME

6       auparse_feed - feed data into parser
7

SYNOPSIS

9       #include <auparse.h>
10
11       int auparse_feed(auparse_state_t *au, const char *data, size_t data_len);
12
13
14       au     The audit parse state
15
16       data   a  buffer  of data to feed into the parser, it is data_len bytes
17              long. The data is copied in the parser, upon return  the  caller
18              may free or reuse the data buffer.
19
20       data_len
21              number of bytes in data
22
23

DESCRIPTION

25       auparse_feed   supplies   new   data   for   the   parser  to  consume.
26       auparse_init()  must  have  been  called  with   a   source   type   of
27       AUSOURCE_FEED and a NULL pointer.
28
29       The  parser  consumes  as  much data as it can invoking a user supplied
30       callback specified with auparse_add_callback with  a  cb_event_type  of
31       AUPARSE_CB_EVENT_READY each time the parser recognizes a complete event
32       in the data stream. Data not fully parsed will persist and be prepended
33       to  the  next  feed  data.  After  all data has been feed to the parser
34       auparse_flush_feed should be called to signal the end of input data and
35       flush any pending parse data through the parsing system.
36
37

EXAMPLE

39       void
40       auparse_callback(auparse_state_t *au, auparse_cb_event_t cb_event_type,
41                        void *user_data)
42       {
43           int *event_cnt = (int *)user_data;
44
45           if (cb_event_type == AUPARSE_CB_EVENT_READY) {
46               if (auparse_first_record(au) <= 0) return;
47               printf("event: %d\n", *event_cnt);
48               printf("records:%d\n", auparse_get_num_records(au));
49               do {
50                   printf("fields:%d\n", auparse_get_num_fields(au));
51                   printf("type=%d ", auparse_get_type(au));
52                   const au_event_t *e = auparse_get_timestamp(au);
53                   if (e == NULL) return;
54                   printf("event time: %u.%u:%lu\n",
55                           (unsigned)e->sec, e->milli, e->serial);
56                   auparse_first_field(au);
57                   do {
58                       printf("%s=%s (%s)\n", auparse_get_field_name(au),
59                              auparse_get_field_str(au),
60                              auparse_interpret_field(au));
61                   } while (auparse_next_field(au) > 0);
62                   printf("\n");
63
64               } while(auparse_next_record(au) > 0);
65               (*event_cnt)++;
66           }
67       }
68
69       main(int argc, char **argv)
70       {
71           char *filename = argv[1];
72           FILE *fp;
73           char buf[256];
74           size_t len;
75           int *event_cnt = malloc(sizeof(int));
76
77           au = auparse_init(AUSOURCE_FEED, 0);
78
79           *event_cnt = 1;
80           auparse_add_callback(au, auparse_callback, event_cnt, free);
81
82           if ((fp = fopen(filename, "r")) == NULL) {
83               fprintf(stderr, "could not open '%s', %s0, filename, strerror(errno));
84               return 1;
85           }
86
87           while ((len = fread(buf, 1, sizeof(buf), fp))) {
88               auparse_feed(au, buf, len);
89           }
90           auparse_flush_feed(au);
91       }
92
93

RETURN VALUE

95       Returns -1 if an error occurs; otherwise, 0 for success.
96
97

SEE ALSO

99       auparse_add_callback(3), auparse_flush_feed(3)
100
101
102

AUTHOR

104       John Dennis
105
106
107
108Red Hat                            May 2007                    AUPARSE_FEED(3)
Impressum