Patch to auparse to handle out of order messages 2 of 3

Steve Grubb sgrubb at redhat.com
Wed Jan 6 15:45:44 UTC 2016


On Wednesday, January 06, 2016 09:29:54 PM Burn Alting wrote:
> #2 - the 'lol' patch itself. Integrate the ausearch/aureport 'lol' code
> into auparse() and adjust auparse() to deal with maintain an incore list
> of incomplete events.

Quick question...there is this:

#define        LOL_EVENTS      1

Couldn't we just assume that this is desired and get rid of all the #ifdefs? 
(You don't need to re-send the patch.) Ideally I would like everyone running 
the same code for support purposes.

-Steve




More information about the Linux-audit mailing list