PATCH: ausearch doesn't correcly act as a filter when no EOF on input

[Steve Grubb]

On Monday 17 November 2008 19:17:54 Tony Jones wrote:
> Issue is that tail -f never indicates EOF and if ausearch stdout is a pipe
> (versus a file), the output can remain queued in the pipebuf.

The general problem is a little bigger. ausearch can't tell when an event is 
complete. It assumes that the kernel serializes things - which it doesn't. 
With files, it flushes everything when it hits EOF. But pipes don't have 
that. The solution I was going to implement was to start a timer when the 
input is a pipe and timeout the currently accumulating event. Flushing the 
output if using a pipe looks like a good measure, too.


> Following patch fixes it, or a simpler patch could unconditionally flush
> stdout.

I'd rather not flush all the time otherwise the performance improvement of 
buffering is lost. I currently have ausearch completely tore apart to rework 
its event collection logic so that interlaced events are assembled correctly 
and completely. Maybe in a few days I can revisit this problem.


> I've not looked for similar issues elsewhere.

aureport shares much of the same IO design and the auparse library also does 
not use clock time to finish off events if the input is a pipe.

-Steve