[PATCH] more message updates

David Woodhouse dwmw2 at infradead.org
Mon May 23 08:01:48 UTC 2005


On Sun, 2005-05-22 at 17:57 -0400, Steve Grubb wrote:
> I was working on the ausearch utility and have it interpreting the logs 
> nicely. There were a couple issues that popped up where some messages did not 
> fall into similar patterns. There are several cases where auid does not have 
> an '=' between it and the loginuid.
> 
> Also, I ran into a problem interpreting syscalls because arch comes after the 
> syscall. Life would be so much easier if arch was before syscall. The 
> attached patch fixes this. Its against the .46 kernel.

I can see the point in the former, but I don't see why the latter makes
any difference. Anyway, as far as I'm concerned they're fine, but I'd
like an ack from Kris.
 
-- 
dwmw2




More information about the Linux-audit mailing list