package reader

import "audit2fivew/internal/reader"

Package reader ingests AVC denial events from the audit subsystem, either by reading the raw log file directly or by shelling out to ausearch(8).

Index

• func Read(path string) ([]*avc.Denial, error)
• func ReadAusearch() ([]*avc.Denial, error)

Functions

func Read

func Read(path string) ([]*avc.Denial, error)

Read parses every AVC denial from the audit log at the given path. Lines that are not valid AVC denials are silently skipped.

func ReadAusearch

func ReadAusearch() ([]*avc.Denial, error)

ReadAusearch runs `ausearch -m avc --raw` and parses the output. It returns an error if ausearch is not installed or fails to execute.