get_field_str() and interpret_field() bug with multi-word fields

[Steve Grubb]

On Tuesday 12 August 2008 13:49:37 Jonathan Kelly wrote:
> When using the python auparse library to call AuParser.interpret_field()
> on a multi-word field, only the first word in the field is returned.
> Using get_field_str() instead of interpret_field() yields the same
> output.  I have verified that this issue exists in the C library, as
> well as the Python.  I suspect that this may be an issue for multi-word
> fields in general, but have not noticed any other than 'op'.

I am going to expose the encoder in libaudit in the next release so that 
fields that have spaces can be escaped such that the parser can handle it. 
Since the next release or two will be going into RHEL5, any other changes are 
a non-starter. 

-Steve