# auparse_feed

## NAME



           auparse_feed - feed data into parser
    


## SYNOPSIS



           **#include <auparse.h>**
    
           **int auparse_feed(auparse_state_t ***_au,_**const** _char_***"**_data,_**size_t"**_data_len);"_
    
           _au_     The audit parse state
    
           _data_   a buffer of data to feed into the parser, it is _data_len_
                  bytes long. The data is copied in the parser, upon return
                  the caller may free or reuse the data buffer.
    
           _data_len_
                  number of bytes in _data_
    


## DESCRIPTION



           _auparse_feed_ supplies new data for the parser to consume.
           _auparse_init()_ must have been called with a source type of
           AUSOURCE_FEED and a NULL pointer.
    
           The parser consumes as much data as it can invoking a user
           supplied callback specified with _auparse_add_callback_ with a
           cb_event_type of _AUPARSE_CB_EVENT_READY_ each time the parser
           recognizes a complete event in the data stream. Data not fully
           parsed will persist and be prepended to the next feed data. After
           all data has been feed to the parser _auparse_flush_feed_ should be
           called to signal the end of input data and flush any pending parse
           data through the parsing system.
    


## RETURN VALUE



           Returns -1 if an error occurs; otherwise, 0 for success.
    


## EXAMPLE



           void
           auparse_callback(auparse_state_t *au, auparse_cb_event_t cb_event_type,
                            void *user_data)
           {
               int *event_cnt = (int *)user_data;
    
               if (cb_event_type == AUPARSE_CB_EVENT_READY) {
                   if (auparse_first_record(au) <= 0) return;
                   printf("event: %d\n", *event_cnt);
                   printf("records:%d\n", auparse_get_num_records(au));
                   do {
                       printf("fields:%d\n", auparse_get_num_fields(au));
                       printf("type=%d ", auparse_get_type(au));
                       const au_event_t *e = auparse_get_timestamp(au);
                       if (e == NULL) return;
                       printf("event time: %lu.%u:%lu\n",
                               (long unsigned)e->sec, e->milli, e->serial);
                       auparse_first_field(au);
                       do {
                           printf("%s=%s (%s)\n", auparse_get_field_name(au),
                                  auparse_get_field_str(au),
                                  auparse_interpret_field(au));
                       } while (auparse_next_field(au) > 0);
                       printf("\n");
    
                   } while(auparse_next_record(au) > 0);
                   (*event_cnt)++;
               }
           }
    
           main(int argc, char **argv)
           {
               char *filename = argv[1];
               FILE *fp;
               char buf[256];
               size_t len;
               int *event_cnt = malloc(sizeof(int));
    
               au = auparse_init(AUSOURCE_FEED, 0);
               auparse_set_eoe_timeout(2);
    
               *event_cnt = 1;
               auparse_add_callback(au, auparse_callback, event_cnt, free);
    
               if ((fp = fopen(filename, "r")) == NULL) {
                   fprintf(stderr, "could not open '%s', %s\n", filename, strerror(errno));
                   return 1;
               }
    
               while ((len = fread(buf, 1, sizeof(buf), fp))) {
                   auparse_feed(au, buf, len);
               }
               auparse_flush_feed(au);
               auparse_destroy(au);
           }
    


* * *