From df5afa4fcd9725380f94ca6476248d4cc24f889a Mon Sep 17 00:00:00 2001 From: Ashlee Young Date: Sun, 29 Nov 2015 08:22:13 -0800 Subject: v2.4.4 audit sources Change-Id: I9315a7408817db51edf084fb4d27fbb492785084 Signed-off-by: Ashlee Young --- framework/src/audit/docs/auparse_interpret_field.3 | 24 ++++++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 framework/src/audit/docs/auparse_interpret_field.3 (limited to 'framework/src/audit/docs/auparse_interpret_field.3') diff --git a/framework/src/audit/docs/auparse_interpret_field.3 b/framework/src/audit/docs/auparse_interpret_field.3 new file mode 100644 index 00000000..2ff5297b --- /dev/null +++ b/framework/src/audit/docs/auparse_interpret_field.3 @@ -0,0 +1,24 @@ +.TH "AUPARSE_INTERPRET_FIELD" "3" "Feb 2007" "Red Hat" "Linux Audit API" +.SH NAME +auparse_interpret_field \- get current field's value interpreted +.SH "SYNOPSIS" +.B #include +.sp +const char *auparse_interpret_field(auparse_state_t *au); + +.SH "DESCRIPTION" + +auparse_interpret_field allows access to the interpreted value in the current field of the current record in the current event. The returned value will be destroyed if you call this function again. If you need to interpret another field and keep this value, you will have to copy it for later use. + +Examples of things that could be interpreted are: uid, gid, syscall numbers, exit codes, file paths, socket addresses, permissions, modes, and capabilities. There are likely to be more in the future. If a value cannot be interpreted, its original value is returned. + +.SH "RETURN VALUE" + +Returns NULL if there is an error otherwise a pointer to the interpreted value. + +.SH "SEE ALSO" + +.BR auparse_get_field_str (3). + +.SH AUTHOR +Steve Grubb -- cgit 1.2.3-korg