Struct Parser

pub struct Parser {
    pub enriched: bool,
    pub split_msg: bool,
}

Parser for Linux Audit messages, with a few configurable options

Fields

enriched: bool

Process enriched (i.e. ALL-CAPS keys). Default: true

split_msg: bool

Try to process common msg=‘…’ strings into key/value maps. Default: true

Implementations

impl Parser

pub fn parse<'a, 'b>(&'a self, raw: &'a [u8]) -> Result<Message<'b>, ParseError>

Parse a single log line as produced by auditd(8)

Trait Implementations

impl Debug for Parser

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Parser

fn default() -> Self

Returns the “default value” for a type.