AUSEARCH\_ADD\_EXPRESSION(3) Linux Audit API AUSEARCH\_ADD\_EXPRESSION(3)

# [NAME](#NAME)

ausearch\_add\_expression - build up search expression

# [SYNOPSIS](#SYNOPSIS)

```
#include <auparse.h>
```

```
int ausearch_add_expression(auparse_state_t *au, const char *expression, char **error, ausearch_rule_t how);"
```

# [DESCRIPTION](#DESCRIPTION)

**ausearch\_add\_item** adds an expression to the current audit search expression. The search conditions can then be used to scan logs, files, or buffers for something of interest. The *expression* parameter contains an expression, as specified in [**ausearch-expression**(5)](/man/os/audit/ausearch-expression.5). The *how* parameter determines how this search expression will affect the existing search expression, if one is already defined. The possible values are:

[*AUSEARCH\_RULE\_CLEAR*](#AUSEARCH_RULE_CLEAR)

Clear the current search expression, if any, and use only this search expression.

[*AUSEARCH\_RULE\_OR*](#AUSEARCH_RULE_OR)

If a search expression *E* is already configured, replace it by **(E || this\_search\_expression)**.

[*AUSEARCH\_RULE\_AND*](#AUSEARCH_RULE_AND)

If a search expression *E* is already configured, replace it by **(E && this\_search\_expression)**.

The caller must free the error message using [**free**(3)](/man/os/audit/free.3). If an error message is not available or can not be allocated, **\*error** is set to **NULL**.

# [SEE ALSO](#SEE_ALSO)

[**ausearch\_add\_item**(3)](/man/os/audit/ausearch_add_item.3), [**ausearch\_add\_interpreted\_item**(3)](/man/os/audit/ausearch_add_interpreted_item.3), [**ausearch\_add\_timestamp\_item**(3)](/man/os/audit/ausearch_add_timestamp_item.3), [**ausearch\_add\_regex**(3)](/man/os/audit/ausearch_add_regex.3), [**ausearch\_set\_stop**(3)](/man/os/audit/ausearch_set_stop.3), [**ausearch\_clear**(3)](/man/os/audit/ausearch_clear.3), [**ausearch\_next\_event**(3)](/man/os/audit/ausearch_next_event.3), [**ausearch\_cur\_event**(3)](/man/os/audit/ausearch_cur_event.3), [**ausearch-expression**(5)](/man/os/audit/ausearch-expression.5).

# [AUTHOR](#AUTHOR)

Miloslav Trmac

Feb 2008 Red Hat

---

Document: ausearch_add_expression(3) from audit 4.2.1-r4 (Chainguard OS)
Source: https://github.com/linux-audit/audit-userspace