auparse_feed(3) [centos man page]

AUPARSE_FEED(3) 						  Linux Audit API						   AUPARSE_FEED(3)

NAME

       auparse_feed - feed data into parser

SYNOPSIS

       #include <auparse.h>

       int auparse_feed(auparse_state_t *au, const char *data, size_t data_len);

       au     The audit parse state

       data   a  buffer  of  data to feed into the parser, it is data_len bytes long. The data is copied in the parser, upon return the caller may
	      free or reuse the data buffer.

       data_len
	      number of bytes in data

DESCRIPTION

       auparse_feed supplies new data for the parser to consume.  auparse_init() must have been called with a source type of AUSOURCE_FEED  and  a
       NULL pointer.

       The  parser  consumes  as much data as it can invoking a user supplied callback specified with auparse_add_callback with a cb_event_type of
       AUPARSE_CB_EVENT_READY each time the parser recognizes a complete event in the data stream. Data not  fully  parsed  will  persist  and	be
       prepended  to the next feed data. After all data has been feed to the parser auparse_flush_feed should be called to signal the end of input
       data and flush any pending parse data through the parsing system.

EXAMPLE

       void
       auparse_callback(auparse_state_t *au, auparse_cb_event_t cb_event_type,
			void *user_data)
       {
	   int *event_cnt = (int *)user_data;

	   if (cb_event_type == AUPARSE_CB_EVENT_READY) {
	       if (auparse_first_record(au) <= 0) return;
	       printf("event: %d
", *event_cnt);
	       printf("records:%d
", auparse_get_num_records(au));
	       do {
		   printf("fields:%d
", auparse_get_num_fields(au));
		   printf("type=%d ", auparse_get_type(au));
		   const au_event_t *e = auparse_get_timestamp(au);
		   if (e == NULL) return;
		   printf("event time: %u.%u:%lu
",
			   (unsigned)e->sec, e->milli, e->serial);
		   auparse_first_field(au);
		   do {
		       printf("%s=%s (%s)
", auparse_get_field_name(au),
			      auparse_get_field_str(au),
			      auparse_interpret_field(au));
		   } while (auparse_next_field(au) > 0);
		   printf("
");

	       } while(auparse_next_record(au) > 0);
	       (*event_cnt)++;
	   }
       }

       main(int argc, char **argv)
       {
	   char *filename = argv[1];
	   FILE *fp;
	   char buf[256];
	   size_t len;
	   int *event_cnt = malloc(sizeof(int));

	   au = auparse_init(AUSOURCE_FEED, 0);

	   *event_cnt = 1;
	   auparse_add_callback(au, auparse_callback, event_cnt, free);

	   if ((fp = fopen(filename, "r")) == NULL) {
	       fprintf(stderr, "could not open '%s', %s
", filename, strerror(errno));
	       return 1;
	   }

	   while ((len = fread(buf, 1, sizeof(buf), fp))) {
	       auparse_feed(au, buf, len);
	   }
	   auparse_flush_feed(au);
       }

RETURN VALUE

       Returns -1 if an error occurs; otherwise, 0 for success.

SEE ALSO

       auparse_add_callback(3), auparse_flush_feed(3), auparse_feed_has_data(3)

AUTHOR

       John Dennis

Red Hat 							     May 2007							   AUPARSE_FEED(3)

GFS_PIO_READLINE(3)													       GFS_PIO_READLINE(3)

NAME

       gfs_pio_readline - read one line

SYNOPSIS

       #include <gfarm/gfarm.h>

       char *gfs_pio_readline (GFS_File f, char **bufp, size_t *sizep, size_t *lenp);

DESCRIPTION

       gfs_pio_readline() reads one line from the file specified by the parameter gf.

       Parameter  bufp	specifies  an  address	of  a pointer variable initialzed by NULL at first.  gfs_pio_readline() allocates a buffer for I/O
       dynamically, and stores the address of the buffer to this variable pointed by bufp.  Parameter sizep specifies an address of a size_t vari-
       able initialized by 0.  This size_t variable is used to record the size of the buffer.  Or, you can specify a buffer allocated by malloc(3)
       in the variable pointed by the parameter bufp.  In this case, you have to specify the size of the allocated buffer by the parameter  sizep.
       If  the	length of the line exceeds the size of the buffer, the buffer will be automatically realloc(3)ed, and the variable pointed by bufp
       and sizep will be updated respectively.	Note that you are responsible to free(3) this buffer.

       This function returns the length of the line to a variable pointed by the parameter lenp.  This length includes newline character.

       Just like gfs_pio_gets(3), this function doesn't remove newline character at the end of lines. Also, this function always appends  ''	at
       the end of strings.  You can deal with lines which include '' character by using the variable pointed by the parameter lenp.

       If the file reaches its end, the length of the result string becomes 0.

       This function is equivalent to gfs_pio_readdelim(f, bufp, sizep, lenp, "
", 1).

RETURN VALUES

       NULL   The function terminated successfully.

       GFARM_ERR_NO_MEMORY
	      Insufficient memory was available.

	      Note that you need to free(3) the buffer pointed by the parameter bufp

       Others An error except the above occurred.  The reason is shown by its pointed strings.

EXAMPLES

   EXAMPLE OF GFS_PIO_READLINE FUNCTION
       #include <stdio.h>
       #include <stdlib.h>
       #include <gfarm/gfarm.h>

       int
       main(int argc, char **argv)
       {
	    char *e;
	    GFS_File gf;
	    size_t bufsize = 0, len;
	    char *buffer = NULL;

	    e = gfarm_initialize(&argc, &argv);
	    if (e != NULL) {
		 fprintf(stderr, "gfarm_initialize: %s
", e);
		 return (EXIT_FAILURE);
	    }
	    if (argc <= 1) {
		 fprintf(stderr, "missing gfarm filename
");
		 return (EXIT_FAILURE);
	    }
	    e = gfs_pio_open(argv[1], GFARM_FILE_RDONLY, &gf);
	    if (e != NULL) {
		 fprintf(stderr, "%s: %s
", argv[1], e);
		 return (EXIT_FAILURE);
	    }
	    e = gfs_pio_set_view_global(gf, 0);
	    if (e != NULL) {
		 fprintf(stderr, "%s: gfs_pio_set_view_global: %s
",
		     argv[1], e);
		 return (EXIT_FAILURE);
	    }

	    while ((e = gfs_pio_readline(gf, &buffer, &bufsize, &len))
		== NULL && len > 0) {
		 printf("<%6d/%6d >%s", len, bufsize, buffer);
	    }
	    if (buffer != NULL)
		 free(buffer);
	    if (e != NULL) {
		 fprintf(stderr, "ERROR: %s
", e);
		 return (EXIT_FAILURE);
	    }
	    e = gfs_pio_close(gf);
	    if (e != NULL) {
		 fprintf(stderr, "gfs_pio_close: %s
", e);
		 return (EXIT_FAILURE);
	    }
	    e = gfarm_terminate();
	    if (e != NULL) {
		 fprintf(stderr, "gfarm_initialize: %s
", e);
		 return (EXIT_FAILURE);
	    }
	    return (EXIT_SUCCESS);
       }

SEE ALSO

       gfs_pio_open(3), gfs_pio_getline(3), gfs_pio_gets(3), gfs_pio_readdelim(3)

Gfarm								    13 May 2004 					       GFS_PIO_READLINE(3)