AUPARSE\_FIRST\_FIELD(3) Linux Audit API AUPARSE\_FIRST\_FIELD(3)

# [NAME](#NAME)

auparse\_first\_field - reposition field cursor

# [SYNOPSIS](#SYNOPSIS)

**#include <auparse.h>**

**int auparse\_first\_field(const auparse\_state\_t \*au);"**

# [DESCRIPTION](#DESCRIPTION)

auparse\_first\_field repositions the library's internal cursor to point to the first field of the current record in the current event.

# [RETURN VALUE](#RETURN_VALUE)

Returns 0 if there is no event data; otherwise, 1 for success.

# [SEE ALSO](#SEE_ALSO)

[**auparse\_next\_field**(3)](/man/os/audit/auparse_next_field.3).

# [AUTHOR](#AUTHOR)

Steve Grubb

Feb 2007 Red Hat

---

Document: auparse_first_field(3) from audit 4.2.1-r3 (Chainguard OS)
Source: https://github.com/linux-audit/audit-userspace