---
name: "ausearch_add_expression"
section: "3"
platform: "linux"
package: "audit"
version: "4.2.1-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/ausearch_add_expression"
---

# ausearch\_add\_expression(3)

build up search expression

## NAME

ausearch\_add\_expression - build up search expression

## SYNOPSIS

```
#include <auparse.h>
```

**int ausearch\_add\_expression(auparse\_state\_t \****au***, const char \****expression***, char \*\****error***, ausearch\_rule\_t** *how***);"**

## DESCRIPTION

**ausearch\_add\_item** adds an expression to the current audit search expression. The search conditions can then be used to scan logs, files, or buffers for something of interest. The *expression* parameter contains an expression, as specified in [**ausearch-expression**(5)](/ausearch-expression/5.md). The *how* parameter determines how this search expression will affect the existing search expression, if one is already defined. The possible values are:

- *AUSEARCH\_RULE\_CLEAR*

  Clear the current search expression, if any, and use only this search expression.

- *AUSEARCH\_RULE\_OR*

  If a search expression *E* is already configured, replace it by **(***E* **\|\| this\_search\_expression)**.

- *AUSEARCH\_RULE\_AND*

  If a search expression *E* is already configured, replace it by **(***E* **&& this\_search\_expression)**.

The caller must free the error message using [**free**(3)](/free/3.md). If an error message is not available or can not be allocated, **\****error* is set to **NULL**.

## SEE ALSO

[**ausearch\_add\_item**(3)](/ausearch_add_item/3.md), [**ausearch\_add\_interpreted\_item**(3)](/ausearch_add_interpreted_item/3.md), [**ausearch\_add\_timestamp\_item**(3)](/ausearch_add_timestamp_item/3.md), [**ausearch\_add\_regex**(3)](/ausearch_add_regex/3.md), [**ausearch\_set\_stop**(3)](/ausearch_set_stop/3.md), [**ausearch\_clear**(3)](/ausearch_clear/3.md), [**ausearch\_next\_event**(3)](/ausearch_next_event/3.md), [**ausearch\_cur\_event**(3)](/ausearch_cur_event/3.md), [**ausearch-expression**(5)](/ausearch-expression/5.md).

## AUTHOR

Miloslav Trmac