[PATCH] more message updates
David Woodhouse
dwmw2 at infradead.org
Mon May 23 17:21:22 UTC 2005
On Mon, 2005-05-23 at 12:06 -0400, Valdis.Kletnieks at vt.edu wrote:
> ($common, $arch, $rest) =~ /(.*)arch=([\S]*)\s(.*)/
> if $arch=64bit then // parse $rest with 64 bit pattern
> else // parse $rest with 32 bit pattern
>
> If there's arch-dependent values in the $common part, you then need to
> re-parse $common as well.
Yeah, Steve explained. In particular he wants to know the arch before
attempting to parse the syscall number. Kris has said it won't impact
their testing so I'm building it into an audit.48 kernel.
--
dwmw2
More information about the Linux-audit
mailing list