auparse_interpret_field()

[klausk at br.ibm.com]

(sorry for the html)

linux-audit-bounces at redhat.com wrote on 11/08/2007 05:26:00 PM:

> env: audit 1.6.2, s390x, RHEL5 in targeted policy, permissive mode
> 
> I'm trying to assign the field name + interpreted value to a variable
> inside my dispatcher plugin. something along these lines:

Trying to debug this problem, I saw that it's happening because the record 
'machine' field in the auparse internal structure is set to '-1':
(gdb) p *r
$17 = {
  record = 0x80041510 "node=kwuser3.edincott.ibm type=SYSCALL 
msg=audit(1194628042.317:58358): arch=80000016 syscall=5 success=yes 
exit=3 a0=800ed250 a1=241 a2=1b6 a3=0 items=1 ppid=14670 pid=14672 auid=0 
uid=0 gid=0 euid=0"..., type = 0, machine = -1, syscall = -1, a0 = 0, a1 = 
0, nv = {head = 0x80039dd0, cur = 0x8002ad10, 
    cnt = 27}, item = 0, list_idx = 0, line_number = 19, next = 0x0}

Any chance this might be happening because I don't have the complete event 
(ie.: the CWD and PATH records are missing in the event) - In this case, 
this would be caused by the record loss in audispd reported in another 
thread...

 Klaus

-- 
Klaus Heinrich Kiwi/Brazil/IBM <klausk at br.ibm.com>
Software Engineer
IBM STG, Linux Technology Center
Phone:(+55-19) 2132-1909 [T/L 839-1909]
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20071109/03e0b84a/attachment.htm>