Audit Parsing Library Requirements

Steve Grubb sgrubb at redhat.com
Thu Mar 16 14:47:18 UTC 2006


On Thursday 16 March 2006 09:26, John D. Ramsdell wrote:
> I decided to write a simple program against the interface defined by
> the Audit Event Parsing Library Specifications, but found a function
> missing from the specification.  I could find no way to get the name
> associated with the current field.  Let me suggest the addition of a
> function with the following prototype.

Hmm, that was there. I'll update the specs. I put the specs off my people page 
a couple days ago. The latest copy is here:

http://people.redhat.com/sgrubb/audit/audit-parse.txt

Thanks for pointing that out. I think there may be 1 or 2 more additions to 
the specs as well.

-Steve




More information about the Linux-audit mailing list