auparse_feed(3) [debian man page]

AUPARSE_FEED(3) 						  Linux Audit API						   AUPARSE_FEED(3)

NAME

       auparse_feed - feed data into parser

SYNOPSIS

       #include <auparse.h>

       int auparse_feed(auparse_state_t *au, const char *data, size_t data_len);

       au     The audit parse state

       data   a  buffer  of  data to feed into the parser, it is data_len bytes long. The data is copied in the parser, upon return the caller may
	      free or reuse the data buffer.

       data_len
	      number of bytes in data

DESCRIPTION

       auparse_feed supplies new data for the parser to consume.  auparse_init() must have been called with a source type of AUSOURCE_FEED  and  a
       NULL pointer.

       The  parser  consumes  as much data as it can invoking a user supplied callback specified with auparse_add_callback with a cb_event_type of
       AUPARSE_CB_EVENT_READY each time the parser recognizes a complete event in the data stream. Data not  fully  parsed  will  persist  and	be
       prepended  to the next feed data. After all data has been feed to the parser auparse_flush_feed should be called to signal the end of input
       data and flush any pending parse data through the parsing system.

EXAMPLE

       void
       auparse_callback(auparse_state_t *au, auparse_cb_event_t cb_event_type,
			void *user_data)
       {
	   int *event_cnt = (int *)user_data;

	   if (cb_event_type == AUPARSE_CB_EVENT_READY) {
	       if (auparse_first_record(au) <= 0) return;
	       printf("event: %d
", *event_cnt);
	       printf("records:%d
", auparse_get_num_records(au));
	       do {
		   printf("fields:%d
", auparse_get_num_fields(au));
		   printf("type=%d ", auparse_get_type(au));
		   const au_event_t *e = auparse_get_timestamp(au);
		   if (e == NULL) return;
		   printf("event time: %u.%u:%lu
",
			   (unsigned)e->sec, e->milli, e->serial);
		   auparse_first_field(au);
		   do {
		       printf("%s=%s (%s)
", auparse_get_field_name(au),
			      auparse_get_field_str(au),
			      auparse_interpret_field(au));
		   } while (auparse_next_field(au) > 0);
		   printf("
");

	       } while(auparse_next_record(au) > 0);
	       (*event_cnt)++;
	   }
       }

       main(int argc, char **argv)
       {
	   char *filename = argv[1];
	   FILE *fp;
	   char buf[256];
	   size_t len;
	   int *event_cnt = malloc(sizeof(int));

	   au = auparse_init(AUSOURCE_FEED, 0);

	   *event_cnt = 1;
	   auparse_add_callback(au, auparse_callback, event_cnt, free);

	   if ((fp = fopen(filename, "r")) == NULL) {
	       fprintf(stderr, "could not open '%s', %s0, filename, strerror(errno));
	       return 1;
	   }

	   while ((len = fread(buf, 1, sizeof(buf), fp))) {
	       auparse_feed(au, buf, len);
	   }
	   auparse_flush_feed(au);
       }

RETURN VALUE

       Returns -1 if an error occurs; otherwise, 0 for success.

SEE ALSO

       auparse_add_callback(3), auparse_flush_feed(3)

AUTHOR

       John Dennis

Red Hat 							     May 2007							   AUPARSE_FEED(3)

Check Out this Related Man Page

GFS_PIO_GETS(3) 														   GFS_PIO_GETS(3)

NAME

       gfs_pio_gets - read one line

SYNOPSIS

       #include <gfarm/gfarm.h>

       char *gfs_pio_gets (GFS_File f, char * s, size_t size);

DESCRIPTION

       gfs_pio_gets()  reads one line from the file specified by the parameter gf to the buffer specified by the parameter s.  You need to specify
       the size of the buffer by the parameter size.

       Unlike gfs_pio_getline(3), this function doesn't remove newline character at the end of the buffer. But if whole contents of the line  can-
       not  be	stored to the buffer due to its length, or if the file reaches the end without newline, there will be no newline at the end of the
       buffer. In any case, one '' character is appended to the end of the buffer.

       If the file reaches its end, the length of the string in the buffer becomes 0.

RETURN VALUES

       NULL   The function terminated successfully.

       GFARM_ERR_NO_MEMORY
	      Insufficient memory was available.

       Others An error except the above occurred.  The reason is shown by its pointed strings.

EXAMPLES

   EXAMPLE OF GFS_PIO_GETS FUNCTION
       #include <stdio.h>
       #include <stdlib.h>
       #include <gfarm/gfarm.h>

       int
       main(int argc, char **argv)
       {
	    char *e;
	    GFS_File gf;
	    char buffer[512];

	    e = gfarm_initialize(&argc, &argv);
	    if (e != NULL) {
		 fprintf(stderr, "gfarm_initialize: %s
", e);
		 return (EXIT_FAILURE);
	    }
	    if (argc <= 1) {
		 fprintf(stderr, "missing gfarm filename
");
		 return (EXIT_FAILURE);
	    }
	    e = gfs_pio_open(argv[1], GFARM_FILE_RDONLY, &gf);
	    if (e != NULL) {
		 fprintf(stderr, "%s: %s
", argv[1], e);
		 return (EXIT_FAILURE);
	    }
	    e = gfs_pio_set_view_global(gf, 0);
	    if (e != NULL) {
		 fprintf(stderr, "%s: gfs_pio_set_view_global: %s
",
		     argv[1], e);
		 return (EXIT_FAILURE);
	    }

	    while ((e = gfs_pio_gets(gf, buffer, sizeof buffer)) != NULL &&
		*buffer != '') {
		 printf("got: %s", buffer);
	    }
	    if (e != NULL) {
		 fprintf(stderr, "ERROR: %s
", e);
		 return (EXIT_FAILURE);
	    }
	    e = gfs_pio_close(gf);
	    if (e != NULL) {
		 fprintf(stderr, "gfs_pio_close: %s
", e);
		 return (EXIT_FAILURE);
	    }
	    e = gfarm_terminate();
	    if (e != NULL) {
		 fprintf(stderr, "gfarm_initialize: %s
", e);
		 return (EXIT_FAILURE);
	    }
	    return (EXIT_SUCCESS);
       }

SEE ALSO

       gfs_pio_open(3), gfs_pio_getline(3), gfs_pio_readline(3), gfs_pio_readdelim(3)

Gfarm								    13 May 2004 						   GFS_PIO_GETS(3)

Linux and UNIX Man Pages

auparse_feed(3) [debian man page]

Check Out this Related Man Page