[PATCH 1/2] fix a bug that use option '-r' cannot output all unformatted logs

[Peng Haitao]

Hello Steve, 

Executing command "echo 'type=CONFIG_CHANGE msg=audit(1214114026.152:1641): op=updated rules specifying path="/home/pht/source/sys_temp" with dev=4294967295 ino=4294967295  list=-672208416 res=1' | ausearch -r", the output is NULL.
The log is from /var/log/audit/audit.log and not modified.

Signed-off-by: Peng Haitao <penght at cn.fujitsu.com>
---
 src/ausearch-parse.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/src/ausearch-parse.c b/src/ausearch-parse.c
index 141fdee..0c38be1 100755
--- a/src/ausearch-parse.c
+++ b/src/ausearch-parse.c
@@ -1403,7 +1403,7 @@ static int parse_simple_message(const lnode *n, search_items *s)
 	// get loginuid
 	str = strstr(n->message, "auid=");
 	if (str == NULL)
-		return 1;
+		return 0;
 	ptr = str + 5;
 	term = strchr(ptr, ' ');
 	if (term)
-- 
1.5.4.2


-- 
Regards
Peng Haitao