event loss with dispatcher?

[John Dennis]

Steve Grubb wrote:
> On Thursday 08 November 2007 16:17:52 klausk at br.ibm.com wrote:
>> Any tips on how can I debug this further?

My apologies, but I haven't been following this thread because I've had 
my head down with other work, but by any chance could the missing audit 
data be explained by out of order event ID's in the audit stream? This 
was a limitation of auparse but I know Steve was planning on fixing 
this. If it hasn't been fixed auparse will appear to drop audit records 
from an event if the audit records for a single event are not 
contigious. Actually I think you'll get multiple copies of the same 
event with each copy containing only part of the audit data, a scenario 
that's confusing and would give the appearance of missing data. Just a 
thought, not sure if it's relevant.

-- 
John Dennis <jdennis at redhat.com>