[PATCH] more message updates

David Woodhouse dwmw2 at infradead.org
Mon May 23 17:21:22 UTC 2005


On Mon, 2005-05-23 at 12:06 -0400, Valdis.Kletnieks at vt.edu wrote:
> ($common, $arch, $rest) =~ /(.*)arch=([\S]*)\s(.*)/
> if $arch=64bit then // parse $rest with 64 bit pattern
> else // parse $rest with 32 bit pattern
> 
> If there's arch-dependent values in the $common part, you then need to
> re-parse $common as well.

Yeah, Steve explained. In particular he wants to know the arch before
attempting to parse the syscall number. Kris has said it won't impact
their testing so I'm building it into an audit.48 kernel.


-- 
dwmw2




More information about the Linux-audit mailing list