1 .TH "AUSEARCH_ADD_expression" "3" "Feb 2008" "Red Hat" "Linux Audit API"
3 ausearch_add_expression \- build up search expression
5 .B #include <auparse.h>
7 \fBint ausearch_add_expression(auparse_state_t *\fIau\fB,
8 const char *\fIexpression\fB, char **\fIerror\fB, ausearch_rule_t \fIhow\fB);\fR
13 adds an expression to the current audit search expression.
14 The search conditions can then be used to scan logs, files, or buffers
15 for something of interest.
18 parameter contains an expression, as specified in
19 .BR ausearch\-expression (5).
24 how this search expression will affect the existing search expression,
25 if one is already defined.
26 The possible values are:
29 .I AUSEARCH_RULE_CLEAR
30 Clear the current search expression, if any,
31 and use only this search expression.
34 If a search expression
36 is already configured,
37 replace it by \fB(\fIE\fB || \fIthis_search_expression\fB)\fR.
40 If a search expression
42 is already configured,
43 replace it by \fB(\fIE\fB && \fIthis_search_expression\fB)\fR.
49 .B ausearch_add_expression
51 Otherwise, it returns \-1, sets
53 and it may set \fB*\fIerror\fR to an error message;
54 the caller must free the error message using
56 If an error message is not available or can not be allocated, \fB*\fIerror\fR
61 .BR ausearch_add_item (3),
62 .BR ausearch_add_interpreted_item (3),
63 .BR ausearch_add_timestamp_item (3),
64 .BR ausearch_add_regex (3),
65 .BR ausearch_set_stop (3),
66 .BR ausearch_clear (3),
67 .BR ausearch_next_event (3),
68 .BR ausearch\-expression (5).