These interfaces document the programming interface for obtaining entries from the audit_event(4) file. getauevent(), getauevnam(), getauevnum(), getauevent(), getauevnam(), and getauevnum() each return a pointer to an audit_event structure.
getauevent() and getauevent_r() enumerate audit_event entries; successive calls to these functions will return either successive audit_event entries or NULL.
getauevnam() and getauevnam_r() search for an audit_event entry with a given event_name.
getauevnum() and getauevnum_r() search for an audit_event entry with a given event_number.
getauevnonam() searches for an audit_event entry with a given event_name and returns the corresponding event number.
setauevent() ``rewinds'' to the beginning of the enumeration of audit_event entries. Calls to getauevnam(), getauevnum(), getauevnonum(), getauevnam_r(), or getauevnum_r() may leave the enumeration in an indeterminate state; setauevent() should be called before
the first getauevent() or getauevent_r().
endauevent() may be called to indicate that audit_event processing is complete; the system may then close any open audit_event file, deallocate
storage, and so forth.
The three functions getauevent_r(), getauevnam_r(), and getauevnum_r() each take an argument e which is a pointer to an au_event_ent_t. This pointer is returned on a successful function call. To assure there is enough space for the information returned, the applications programmer should be sure to allocate AU_EVENT_NAME_MAX and AU_EVENT_DESC_MAX bytes for the ae_name and ac_desc elements of the au_event_ent_t data structure.
The internal representation of an audit_event entry is an struct au_event_ent structure defined in <bsm/libbsm.h> with
the following members: