auparse_feed - Man Page

#include <auparse.h>

int auparse_feed(auparse_state_t *au,constchar*"data,size_t"data_len);"

au

The audit parse state

data

a buffer of data to feed into the parser, it is data_len bytes long. The data is copied in the parser, upon return the caller may free or reuse the data buffer.

data_len

number of bytes in data

auparse_feed supplies new data for the parser to consume. auparse_init() must have been called with a source type of AUSOURCE_FEED and a NULL pointer. auparse_add_callback() must be called before feeding data so that complete events have a consumer.

The parser consumes as much data as it can invoking a user supplied callback specified with auparse_add_callback with a cb_event_type of AUPARSE_CB_EVENT_READY each time the parser recognizes a complete event in the data stream. Data not fully parsed will persist and be prepended to the next feed data. After all data has been feed to the parser auparse_flush_feed should be called to signal the end of input data and flush any pending parse data through the parsing system. Malformed feed records are rejected and are not passed to the callback. If malformed records are found, parsing continues for the rest of the available feed data before auparse_feed returns an error.

Returns -1 if an error occurs; otherwise, 0 for success. When -1 is returned, errno is set to indicate the error. The value of errno is meaningful only after an error return; callers should not assume it is cleared after a successful call. Applications that may run with libauparse from before audit-4.1.5 should set errno to 0 before calling auparse_feed. If auparse_feed returns -1 and errno is still 0, the runtime library is using the older error behavior and did not set errno. Clearing errno first avoids treating a pre-existing value as if it were set by auparse_feed.

EINVAL

The parser state is invalid, the parser was not initialized with AUSOURCE_FEED, the input arguments are invalid, or no callback has been registered.

ENOMEM

Memory allocation failed while buffering or parsing feed data.

EBADMSG

A malformed feed record was found. The malformed record was rejected and was not passed to the callback. Parsing continues for the rest of the available feed data before this error is returned.

EIO

An internal parser failure occurred without a more specific error code.

void
auparse_callback(auparse_state_t *au, auparse_cb_event_t cb_event_type,
                 void *user_data)
{
    int *event_cnt = (int *)user_data;

    if (cb_event_type == AUPARSE_CB_EVENT_READY) {
        if (auparse_first_record(au) <= 0) return;
        printf("event: %d\n", *event_cnt);
        printf("records:%d\n", auparse_get_num_records(au));
        do {
            printf("fields:%d\n", auparse_get_num_fields(au));
            printf("type=%d ", auparse_get_type(au));
            const au_event_t *e = auparse_get_timestamp(au);
            if (e == NULL) return;
            printf("event time: %lu.%u:%lu\n",
                    (long unsigned)e->sec, e->milli, e->serial);
            auparse_first_field(au);
            do {
                printf("%s=%s (%s)\n", auparse_get_field_name(au),
                       auparse_get_field_str(au),
                       auparse_interpret_field(au));
            } while (auparse_next_field(au) > 0);
            printf("\n");

        } while(auparse_next_record(au) > 0);
        (*event_cnt)++;
    }
}

main(int argc, char **argv)
{
    char *filename = argv[1];
    FILE *fp;
    char buf[256];
    size_t len;
    int *event_cnt = malloc(sizeof(int));

    au = auparse_init(AUSOURCE_FEED, 0);
    auparse_set_eoe_timeout(2);

    *event_cnt = 1;
    auparse_add_callback(au, auparse_callback, event_cnt, free);

    if ((fp = fopen(filename, "r")) == NULL) {
        fprintf(stderr, "could not open '%s', %s\n", filename, strerror(errno));
        return 1;
    }

    while ((len = fread(buf, 1, sizeof(buf), fp))) {
        auparse_feed(au, buf, len);
    }
    auparse_flush_feed(au);
    auparse_destroy(au);
}

auparse_add_callback(3), auparse_flush_feed(3), auparse_feed_age_events(3), auparse_feed_has_data(3), auparse_metrics(3)

John Dennis

auditd-plugins(5), auparse_add_callback(3), auparse_feed_age_events(3), auparse_feed_has_data(3), auparse_flush_feed(3), auparse_init(3), auparse_metrics(3), auplugin(3).