auparse_interpret_field()

[Steve Grubb]

On Friday 09 November 2007 12:15:43 klausk at br.ibm.com wrote:
> Trying to debug this problem, I saw that it's happening because the record
> 'machine' field in the auparse internal structure is set to '-1':

That would do it. Now...how did that happen? arch says its a 64 bit S390 
machine.

> (gdb) p *r
> $17 = {
>   record = 0x80041510 "node=kwuser3.edincott.ibm type=SYSCALL
> msg=audit(1194628042.317:58358): arch=80000016 syscall=5 success=yes
> exit=3 a0=800ed250 a1=241 a2=1b6 a3=0 items=1 ppid=14670 pid=14672 auid=0
> uid=0 gid=0 euid=0"..., type = 0, machine = -1, syscall = -1, a0 = 0, a1 =
> 0, nv = {head = 0x80039dd0, cur = 0x8002ad10,
>     cnt = 27}, item = 0, list_idx = 0, line_number = 19, next = 0x0}
>
> Any chance this might be happening because I don't have the complete event

Nope, this gets pulled out of syscall records.

-Steve