<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type"> <title></title> </head> <body bgcolor="#ffffff" text="#000000"> Eric Paris wrote: <blockquote cite="mid:1218116377.5837.67.camel@localhost.localdomain" type="cite"> <pre wrap="">On Thu, 2008-08-07 at 12:50 +0800, Chu Li wrote: </pre> <blockquote type="cite"> <pre wrap="">Hi Steve, When auditd is stoped, "auditctl -s" will show "pid=0". I think it's not correct information. It's better to tell users "auditd not started". </pre> </blockquote> <pre wrap=""> We do try to keep the whole key=value pair thing in audit records. I'd be willing to go with something like -1 to make it really clear, but with the number of complaints about the inconsistencies of audit records from people like John Dennis I'm not sure I'm a fan of this patch.... </pre> </blockquote> Thank you Eric! We should be moving toward consistent formatting of audit records and one of the most important consistencies to achieve if we do modify the records is that all data is in the form of key=value. Embedding random strings into records makes parsing difficult especially when the record format varies by kernel version, which this patch would do (at least the proposed string didn't contain any embedded spaces!) NAK to this patch. I think Eric's suggestion of pid=-1 is a good one. <pre class="moz-signature" cols="72">-- John Dennis <a class="moz-txt-link-rfc2396E" href="mailto:jdennis@redhat.com"><jdennis@redhat.com></a> </pre> </body> </html>