AUSEARCH\_SET\_STOP(3) Linux Audit API AUSEARCH\_SET\_STOP(3)

# [NAME](#NAME)

ausearch\_set\_stop - set the cursor position

# [SYNOPSIS](#SYNOPSIS)

**#include <auparse.h>**

**int ausearch\_set\_stop(auparse\_state\_t \*au,austop\_t"where);"**

# [DESCRIPTION](#DESCRIPTION)

ausearch\_set\_stop determines where the internal cursor will stop when a search condition is met. The possible values are:

[*AUSEARCH\_STOP\_EVENT*](#AUSEARCH_STOP_EVENT)

This one repositions the cursors to the first field of the first record of the event containing the items searched for.

[*AUSEARCH\_STOP\_RECORD*](#AUSEARCH_STOP_RECORD)

This one repositions the cursors to the first field of the record containing the items searched for.

[*AUSEARCH\_STOP\_FIELD*](#AUSEARCH_STOP_FIELD)

This one simply stops on the current field when the evaluation of the rules becomes true.

# [RETURN VALUE](#RETURN_VALUE)

Returns -1 if an error occurs; otherwise, 0 for success.

# [SEE ALSO](#SEE_ALSO)

[**ausearch\_add\_item**(3)](/man/os/audit/ausearch_add_item.3), [**ausearch\_add\_regex**(3)](/man/os/audit/ausearch_add_regex.3), [**ausearch\_clear**(3)](/man/os/audit/ausearch_clear.3), [**ausearch\_cur\_event**(3)](/man/os/audit/ausearch_cur_event.3), [**ausearch\_next\_event**(3)](/man/os/audit/ausearch_next_event.3).

# [AUTHOR](#AUTHOR)

Steve Grubb

Feb 2007 Red Hat

---

Document: ausearch_set_stop(3) from audit 4.2.1-r1 (Chainguard OS)
Source: https://github.com/linux-audit/audit-userspace