AUPARSE\_ADD\_CALLBACK(3) Linux Audit API AUPARSE\_ADD\_CALLBACK(3)

# [NAME](#NAME)

auparse\_add\_callback - add a callback handler for notifications

# [SYNOPSIS](#SYNOPSIS)

**#include <auparse.h>**

```
void auparse_add_callback(auparse_state_t *au, auparse_callback_ptr callback, void *user_data, user_destroy user_destroy_func);
```

# [DESCRIPTION](#DESCRIPTION)

auparse\_add\_callback adds a callback function to the parse state which is invoked to notify the application of parsing events. This is part of the event feed API.

The signature of the callback is:

```
void
auparse_callback(auparse_state_t *au, auparse_cb_event_t cb_event_type,


                 void *user_data);
```

When the callback is invoked it is passed:

[*au*](#au)

a pointer to the parse\_state

[*cb\_event\_type*](#cb_event_type)

enumerated value indicating the reason why the callback was invoked

[*user\_data*](#user_data)

pointer to user supplied private data. May be NULL.

[*user\_destroy\_func*](#user_destroy_func)

pointer to function called when user\_data is destroyed. May be NULL. The signature is:

```
void destroy(void *user_data);
```

The destroy() function should be prepared to accept user\_data possibly being NULL.

The *cb\_event\_type* argument indicates why the callback was invoked. It's possible values are:

[**AUPARSE\_CB\_EVENT\_READY**](#AUPARSE_CB_EVENT_READY)

A complete event has been parsed and is ready to be examined. This is logically equivalent to the parse state immediately following *auparse\_next\_event()*

See [auparse\_feed(3)](/man/os/audit/auparse_feed.3) for a complete code example.

# [RETURN VALUE](#RETURN_VALUE)

None.

# [SEE ALSO](#SEE_ALSO)

[**auparse\_feed**(3)](/man/os/audit/auparse_feed.3), [**auparse\_flush\_feed**(3)](/man/os/audit/auparse_flush_feed.3).

# [AUTHOR](#AUTHOR)

John Dennis

May 2007 Red Hat

---

Document: auparse_add_callback(3) from audit 4.2.1-r1 (Chainguard OS)
Source: https://github.com/linux-audit/audit-userspace