auparse question
Steve Grubb
sgrubb at redhat.com
Wed Aug 31 16:49:05 UTC 2011
On Tuesday, August 30, 2011 05:12:17 PM LC Bruzenak wrote:
> I'm using auparse_get_field_type from the parse lib.
> The return value for error is "0" which is also that of the AUDIT_PID
> field.
>
> Right? I am getting some errors that thought they were PIDs.
That does seem to be a mistake in the API. As a workaround for this, you can check for
an error with auparse_get_record_text() == NULL. I suppose I could fix the problem
going forward by making auparse_get_type() return -1 on error.
-Steve
More information about the Linux-audit
mailing list