(

[Tony Nelson]

At 5:41 PM -0800 3/2/07, Steve G wrote:
>> The order may vary, but all events for a particular file come in a group,
>> according to parse_events and man auparse_next_record.  It's the same event
>> while the strings match up to the first ")" ("audit(1234567890.123:1): ").
>
>The events can come at random order but its not something that happens much.
>
>> but it seems to rely on more of auparse's internals than would looking
>>at the
>> start of the string.
>
>I will be fixing auparse to handle out of order events. If you just assume
>it does the right thing for now, I should have it doing the right thing in
>all cases in the next release or two.

I'm not sure that I understand you.  Are you saying that the code in
readahead-collector parse_events() currently doesn't work?  In any case,
what does that have to do with my statement, that writing events by hand to
pass to auparse relies more on auparse's internals than gathering all
events for a file by looking at the ""audit(1234567890.123:1): " at the
beginning of each event?
-- 
____________________________________________________________________
TonyN.:'                       <mailto:tonynelson at georgeanelson.com>
      '                              <http://www.georgeanelson.com/>