AUPARSE\_NORMALIZE(3) Linux Audit API AUPARSE\_NORMALIZE(3)

# [NAME](#NAME)

auparse\_normalize - normalize the current event

# [SYNOPSIS](#SYNOPSIS)

**#include <auparse.h>**

**int auparse\_normalize(auparse\_state\_t \*au,normalize\_option\_t"opt);"**

# [DESCRIPTION](#DESCRIPTION)

**auparse\_normalize** analyzes the current event so that the important information about the event can be accessed through a normalized API which positions to internal field cursor to the exact record and field when asked about specific information.

The auparse\_normalize function takes an opt argument to tell it how much information to gather. Legal values are:

```
	NORM_OPT_ALL - gather maximum information
	NORM_OPT_NO_ATTRS - do not gather subject/object attribute information
```

# [RETURN VALUE](#RETURN_VALUE)

Returns 0 on success and 1 on error.

# [SEE ALSO](#SEE_ALSO)

[**auparse\_normalize\_subject\_primary**(3)](/man/os/audit/auparse_normalize_subject_primary.3)**,** [**auparse\_normalize\_object\_primary**(3)](/man/os/audit/auparse_normalize_object_primary.3).

# [AUTHOR](#AUTHOR)

Steve Grubb

Feb 2017 Red Hat

---

Document: auparse_normalize(3) from audit 4.2.1-r1 (Chainguard OS)
Source: https://github.com/linux-audit/audit-userspace