auparse, stdin, and AUPARSE_CB_EVENT_READY

[dump at tzib.net]

Hi,

I made a audispd plugin, which reads from stdin and sends the strings to
auparse_feed() (auditd-2.1.3).


This works fine on the command line.

When called from audispd however, it gives AUPARSE_CB_EVENT_READY for
each single message, instead of after a complete event has been parsed.

So when you have 4 messages for one event:
- each of them appear as a single event when the plugin is started via
audispd.
- a single even for all 4 messages appear when the plugin is started on
the command line (and the log data fed via stdin, like cat test |
audispd-testplugin)

Looking at the write code it looks ok (audisp/audispd.c):

static int write_to_plugin(event_t *e, const char *string, size_t
string_len,
.. (note that i'm using string type so its the string code part)
if (conf->p->format == F_STRING) {
do {
rc = write(conf->p->plug_pipe[1], string, string_len);
} while (rc < 0 && errno == EINTR);
}

Do you know what causes this behavior, and/or how to "fix" it?


Thanks