From df5afa4fcd9725380f94ca6476248d4cc24f889a Mon Sep 17 00:00:00 2001 From: Ashlee Young Date: Sun, 29 Nov 2015 08:22:13 -0800 Subject: v2.4.4 audit sources Change-Id: I9315a7408817db51edf084fb4d27fbb492785084 Signed-off-by: Ashlee Young --- framework/src/audit/docs/auparse_find_field.3 | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 framework/src/audit/docs/auparse_find_field.3 (limited to 'framework/src/audit/docs/auparse_find_field.3') diff --git a/framework/src/audit/docs/auparse_find_field.3 b/framework/src/audit/docs/auparse_find_field.3 new file mode 100644 index 00000000..4062588f --- /dev/null +++ b/framework/src/audit/docs/auparse_find_field.3 @@ -0,0 +1,23 @@ +.TH "AUPARSE_FIND_FIELD" "3" "Feb 2007" "Red Hat" "Linux Audit API" +.SH NAME +auparse_find_field \- search for field name +.SH "SYNOPSIS" +.B #include +.sp +const char *auparse_find_field(auparse_state_t *au, const char *name); + +.SH "DESCRIPTION" + +auparse_find_field will scan all records in an event to find the first occurance of the field name passed to it. Searching begins from the cursor's current position. The field name is stored for subsequent searching. + +.SH "RETURN VALUE" + +Returns NULL field not found. If an error occurs errno will be set. Otherwise, it returns a pointer to the text value associated with the field. + +.SH "SEE ALSO" + +.BR auparse_first_record (3), +.BR auparse_find_field_next (3). + +.SH AUTHOR +Steve Grubb -- cgit 1.2.3-korg