AUSEARCH_SET_STOP(3) Linux Audit API AUSEARCH_SET_STOP(3)

NAME ausearch_set_stop - set the cursor position

SYNOPSIS #include <auparse.h>

int ausearch_set_stop(auparse_state_t *au, austop_t where);

DESCRIPTION ausearch_set_stop determines where the internal cursor will stop when a search condition is met. The possible values are:

AUSEARCH_STOP_EVENT This one repositions the cursors to the first field of the first record of the event containing the items searched for.

AUSEARCH_STOP_RECORD This one repositions the cursors to the first field of the record containing the items searched for.

AUSEARCH_STOP_FIELD This one simply stops on the current field when the eval- uation of the rules becomes true.

RETURN VALUE Returns -1 if an error occurs; otherwise, 0 for success.

SEE ALSO ausearch_add_item(3), ausearch_add_regex(3), ausearch_clear(3), ause- arch_next_event(3).

AUTHOR Steve Grubb

Red Hat Feb 2007 AUSEARCH_SET_STOP(3)