AUPARSE_NEW_BUFFER(3) Linux Audit API AUPARSE_NEW_BUFFER(3)

auparse_new_buffer - replace the buffer in the parser

#include <auparse.h>

int auparse_new_buffer(auparse_state_t *au,constchar*"data,size_t"data_len);"
The audit parse state
A buffer of data to give to the parser, it is data_len bytes long. The data is copied into the parser without modifying the original. Upon return the caller may free or reuse the data buffer.
The number of bytes in data

auparse_new_buffer replaces the data that the parser works on. auparse_init() must have been called with a source type of AUSOURCE_BUFFER.

Returns 1 if an error occurs; otherwise, 0 for success.

auparse_init(3)

June 2025 Red Hat