ausearch_set_stop man page

ausearch_set_stop — set the cursor position

Synopsis

#include <auparse.h>

int ausearch_set_stop(auparse_state_t *au, austop_t where);

Description

ausearch_set_stop determines where the internal cursor will stop when a search condition is met. The possible values are:

AUSEARCH_STOP_EVENT
This one repositions the cursors to the first field of the first record of the event containing the items searched for.
AUSEARCH_STOP_RECORD
This one repositions the cursors to the first field of the record containing the items searched for.
AUSEARCH_STOP_FIELD
This one simply stops on the current field when the evaluation of the rules becomes true.

Return Value

Returns -1 if an error occurs; otherwise, 0 for success.

See Also

ausearch_add_item(3), ausearch_add_regex(3), ausearch_clear(3), ausearch_next_event(3).

Author

Steve Grubb

Referenced By

ausearch_add_expression(3), ausearch_add_interpreted_item(3), ausearch_add_item(3), ausearch_add_timestamp_item(3), ausearch_add_timestamp_item_ex(3), ausearch_next_event(3).

Feb 2007 Red Hat Linux Audit API