1AUPARSE_INTERPRET_FIELD(3)      Linux Audit API     AUPARSE_INTERPRET_FIELD(3)
2
3
4

NAME

6       auparse_interpret_field - get current field's value interpreted
7

SYNOPSIS

9       #include <auparse.h>
10
11       const char *auparse_interpret_field(auparse_state_t *au);
12
13

DESCRIPTION

15       auparse_interpret_field  allows  access to the interpreted value in the
16       current field of the current record in the current event. The  returned
17       value will be destroyed if you call this function again. If you need to
18       interpret another field and keep this value, you will have to  copy  it
19       for later use.
20
21       Examples  of  things  that  could be interpreted are: uid, gid, syscall
22       numbers, exit codes, file paths, socket addresses, permissions,  modes,
23       and capabilities. There are likely to be more in the future. If a value
24       cannot be interpreted, its original value is returned.
25
26

RETURN VALUE

28       Returns NULL if there is an error otherwise a  pointer  to  the  inter‐
29       preted value.
30
31

SEE ALSO

33       auparse_get_field_str(3).
34
35

AUTHOR

37       Steve Grubb
38
39
40
41Red Hat                            Feb 2007         AUPARSE_INTERPRET_FIELD(3)