Struct AuditQueryFilter 

pub struct AuditQueryFilter {
    pub category_mask: u16,
    pub min_severity: Option<AuditSeverity>,
    pub pid: u64,
    pub time_min: u64,
    pub time_max: u64,
    pub failures_only: bool,
}

Multi-dimensional filter for querying audit events.

Fields

category_mask: u16

Bitmask of enabled categories (0 = match all)

min_severity: Option<AuditSeverity>

Minimum severity to include (None = all)

pid: u64

Filter by PID (0 = match all)

time_min: u64

Start of time range (0 = no lower bound)

time_max: u64

End of time range (0 = no upper bound)

failures_only: bool

Only include failures (false = include all)

Implementations

impl AuditQueryFilter

pub const fn match_all() -> Self

Create a filter that matches everything.

pub fn matches(&self, entry: &AuditEntry) -> bool

Check if a given entry passes this filter.

Trait Implementations

impl Clone for AuditQueryFilter

fn clone(&self) -> AuditQueryFilter

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AuditQueryFilter

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Copy for AuditQueryFilter