(

[Steve G]

> The order may vary, but all events for a particular file come in a group,
> according to parse_events and man auparse_next_record.  It's the same event
> while the strings match up to the first ")" ("audit(1234567890.123:1): ").

The events can come at random order but its not something that happens much.

> but it seems to rely on more of auparse's internals than would looking at the
> start of the string.

I will be fixing auparse to handle out of order events. If you just assume it
does the right thing for now, I should have it doing the right thing in all cases
in the next release or two.

-Steve


 
____________________________________________________________________________________
Have a burning question?  
Go to www.Answers.yahoo.com and get answers from real people who know.