difficulty with TYPE

[Steve Grubb]

On Tuesday 15 January 2008 08:33:59 James Antill wrote:
> >         /* Get header first. it is fixed size */
> >         vec[0].iov_base = (void*)&hdr;
> >         vec[0].iov_len = sizeof(hdr);
> >
> >             // Next payload
> >         vec[1].iov_base = data;
> >         vec[1].iov_len = MAX_AUDIT_MESSAGE_LENGTH;
> >
> >         rc = readv(pipe_fd, vec, 2);
> >         if (rc == 0 || rc == -1) {
>
>  The second iovec above can't just be MAX_AUDIT_MESSAGE_LENGTH, or if
> there are two messages you'll read some/all of the next one(s).

I am fixing the example code to match the code in 1.6.5's audispd program. The 
example code was included 2 years ago before we had a working audispd program 
so that people that were ambitious could write their own. At this point, 
audispd is working and people can just code plugins which auparse does work 
with when the string mode is selected for output format. See the audispd man 
page for more info.

-Steve