Auparse feature or bug

[Burn Alting]

Hi,

When the auparse library parses certain USER_* type events it appears to
have an issue key values with embedded spaces. For example, the event

        type=USER_CHAUTHTOK msg=audit(1363256032.497:202603): user
        pid=24180 uid=0 auid=500 ses=1 msg='op=change password id=500
        exe="/usr/bin/passwd" hostname=? addr=?  terminal=pts/1
        res=success'

when parsed using the code identified in auparse_feed(1), will result in

        event: 1
        records:1
        fields:12
        type=1108 event time: 1363256032.497:202603
        type=USER_CHAUTHTOK (USER_CHAUTHTOK)
        pid=24180 (24180)
        uid=0 (root)
        auid=500 (burn)
        ses=1 (1)
        op=change (change)
        id=500 (burn)
        exe="/usr/bin/passwd" (/usr/bin/passwd)
        hostname=? (?)
        addr=? (?)
        terminal=pts/1 (pts/1)
        res=success (success)

As you can see, we have lost the 'password' element of the
	"op=change password"
key value pair in the original event.

Is this a feature or bug???

Regards
Burn


Regards
Burn Alting