(sorry for the html) <tt>linux-audit-bounces@redhat.com wrote on 11/08/2007 05:26:00 PM: > env: audit 1.6.2, s390x, RHEL5 in targeted policy, permissive mode > > I'm trying to assign the field name + interpreted value to a variable > inside my dispatcher plugin. something along these lines: </tt> Trying to debug this problem, I saw that it's happening because the record 'machine' field in the auparse internal structure is set to '-1': (gdb) p *r $17 = { record = 0x80041510 "node=kwuser3.edincott.ibm type=SYSCALL msg=audit(1194628042.317:58358): arch=80000016 syscall=5 success=yes exit=3 a0=800ed250 a1=241 a2=1b6 a3=0 items=1 ppid=14670 pid=14672 auid=0 uid=0 gid=0 euid=0"..., type = 0, machine = -1, syscall = -1, a0 = 0, a1 = 0, nv = {head = 0x80039dd0, cur = 0x8002ad10, cnt = 27}, item = 0, list_idx = 0, line_number = 19, next = 0x0} Any chance this might be happening because I don't have the complete event (ie.: the CWD and PATH records are missing in the event) - In this case, this would be caused by the record loss in audispd reported in another thread... Klaus -- Klaus Heinrich Kiwi/Brazil/IBM <klausk@br.ibm.com> Software Engineer IBM STG, Linux Technology Center Phone:(+55-19) 2132-1909 [T/L 839-1909]