From: Steve Grubb <sgrubb@redhat.com>
To: linux-audit@redhat.com
Subject: Re: comparing record ids in auparse
Date: Wed, 5 Sep 2007 12:23:59 -0400 [thread overview]
Message-ID: <200709051223.59958.sgrubb@redhat.com> (raw)
In-Reply-To: <1189008706.15928.12.camel@junko.usersys.redhat.com>
On Wednesday 05 September 2007 12:11:46 John Dennis wrote:
> In the functions auparse_timestamp_compare() and events_are_equal() the
> host field is not checked, is that by design or omission?
When the API was designed, the node was not part of the records. Its only
since audit-1.6 that it was. I had not considered adding a node check since
the function was originally there to add comparing two datatypes that are not
straight forward.
> Should two different events from two different hosts be comparable?
In a consolidated log, they are not equal. I suppose that should be fixed in
the next release.
> Are we too far down the road to call this object an 'event_id'?
Yes.
-Steve
next prev parent reply other threads:[~2007-09-05 16:23 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2007-09-05 16:11 comparing record ids in auparse John Dennis
2007-09-05 16:23 ` Steve Grubb [this message]
2007-09-05 16:37 ` John Dennis
2007-09-05 17:17 ` Steve Grubb
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200709051223.59958.sgrubb@redhat.com \
--to=sgrubb@redhat.com \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.