---
title: es_event_lookup_t
framework: endpointsecurity
role: symbol
role_heading: Structure
path: endpointsecurity/es_event_lookup_t
---

# es_event_lookup_t

A type for an event that indicates the lookup of a file’s path.

## Declaration

```swift
struct es_event_lookup_t
```

## Overview

Overview This event represents a call to mpo_vnode_check_lookup_preflight, which the system performs prior to looking up a path. Endpoint Security always delivers this event for file system path access, even if the path doesn’t exist (which prevents an “open” or “close” event from occurring).

## Topics

### Inspecting Event Properties

- [source_dir](endpointsecurity/es_event_lookup_t/source_dir.md)
- [relative_target](endpointsecurity/es_event_lookup_t/relative_target.md)
- [reserved](endpointsecurity/es_event_lookup_t/reserved.md)

### Initializers

- [init(source_dir:relative_target:reserved:)](endpointsecurity/es_event_lookup_t/init(source_dir:relative_target:reserved:).md)

## Relationships

### Conforms To

- [BitwiseCopyable](swift/bitwisecopyable.md)

## See Also

### File-System Event Types

- [es_file_t](endpointsecurity/es_file_t.md)
- [es_event_access_t](endpointsecurity/es_event_access_t.md)
- [es_event_clone_t](endpointsecurity/es_event_clone_t.md)
- [es_event_copyfile_t](endpointsecurity/es_event_copyfile_t.md)
- [es_event_create_t](endpointsecurity/es_event_create_t.md)
- [es_event_dup_t](endpointsecurity/es_event_dup_t.md)
- [es_event_fcntl_t](endpointsecurity/es_event_fcntl_t.md)
- [es_event_open_t](endpointsecurity/es_event_open_t.md)
- [es_event_close_t](endpointsecurity/es_event_close_t.md)
- [es_event_rename_t](endpointsecurity/es_event_rename_t.md)
- [es_event_truncate_t](endpointsecurity/es_event_truncate_t.md)
- [es_event_exchangedata_t](endpointsecurity/es_event_exchangedata_t.md)
- [es_event_write_t](endpointsecurity/es_event_write_t.md)
- [es_event_searchfs_t](endpointsecurity/es_event_searchfs_t.md)