AUPARSE\_NEW\_BUFFER(3) Linux Audit API AUPARSE\_NEW\_BUFFER(3)

# [NAME](#NAME)

auparse\_new\_buffer - replace the buffer in the parser

# [SYNOPSIS](#SYNOPSIS)

**#include <auparse.h>**

```
int auparse_new_buffer(auparse_state_t *au,constchar*"data,size_t"data_len);"
```

[*au*](#au)

The audit parse state

[*data*](#data)

A buffer of data to give to the parser, it is *data\_len* bytes long. The data is copied into the parser without modifying the original. Upon return the caller may free or reuse the data buffer.

[*data\_len*](#data_len)

The number of bytes in *data*

# [DESCRIPTION](#DESCRIPTION)

*auparse\_new\_buffer* replaces the data that the parser works on. *auparse\_init()* must have been called with a source type of AUSOURCE\_BUFFER.

# [RETURN VALUE](#RETURN_VALUE)

Returns 1 if an error occurs; otherwise, 0 for success.

# [SEE ALSO](#SEE_ALSO)

[**auparse\_init**(3)](/man/os/audit/auparse_init.3)

June 2025 Red Hat

---

Document: auparse_new_buffer(3) from audit 4.2.1-r1 (Chainguard OS)
Source: https://github.com/linux-audit/audit-userspace