Refactoring src/ausearch-report.c:output_interpreted_node()

Steve Grubb sgrubb at redhat.com
Tue Oct 7 15:26:49 UTC 2014


On Tue, 07 Oct 2014 20:31:30 +1100
Burn Alting <burn at swtf.dyndns.org> wrote:
> This patch prevents ausearch from parsing an event's "header" of node,
> type, time and serial twice. That is
> [node=<node>] type=<type> msg=audit(<epochsecs>.<msecs>:<serial>)
> 
> It does this by passing the llist->e value to
> output_interpreted_node() as this structure holds the already parsed
> event "header" information.
> 
> The code does not change the ausearch -i output.

Thanks for the patch. I've applied it locally and it seems to work
fine. Will commit it as soon as I can.

-Steve




More information about the Linux-audit mailing list