AUSEARCH_ADD_ITEM(3) ausearch_add_item - #include int ausearch_add_item(auparse_state_t *au, const char *field, const char *op, const char *value, ausearch_rule_t how);" ausearch_add_item . . field value . op . op : exists = . != . . AUPARSE_TYPE_ESCAPED ausearch_add_interpreted_item() . how . : AUSEARCH_RULE_CLEAR . AUSEARCH_RULE_OR E (E || this_search_condition). AUSEARCH_RULE_AND E (E && this_search_condition). -1 0 . ausearch_add_expression(3), ausearch_add_interpreted_item(3), ausearch_add_timestamp_item(3), ausearch_add_regex(3), ausearch_set_stop(3), ausearch_clear(3), ausearch_next_event(3), ausearch_cur_event(3), ausearch-expression(5). Steve Grubb 3 . . : . 2012 AUSEARCH_ADD_ITEM(3)