auparse question

Steve Grubb sgrubb at redhat.com
Wed Aug 31 16:49:05 UTC 2011


On Tuesday, August 30, 2011 05:12:17 PM LC Bruzenak wrote:
> I'm using auparse_get_field_type from the parse lib.
> The return value for error is "0" which is also that of the AUDIT_PID
> field.
> 
> Right? I am getting some errors that thought they were PIDs.

That does seem to be a mistake in the API. As a workaround for this, you can check for 
an error with auparse_get_record_text() == NULL. I suppose I could fix the problem 
going forward by making auparse_get_type() return -1 on error.

-Steve




More information about the Linux-audit mailing list