From: Steve Grubb <sgrubb@redhat.com>
To: linux-audit@redhat.com, burn@swtf.dyndns.org
Subject: Re: Auparse feature or bug
Date: Thu, 14 Mar 2013 06:54:20 -0400 [thread overview]
Message-ID: <2011116.HnREtfWCp5@x2> (raw)
In-Reply-To: <1363256490.3199.23.camel@swtf.swtf.dyndns.org>
On Thursday, March 14, 2013 09:21:30 PM Burn Alting wrote:
> As you can see, we have lost the 'password' element of the
> "op=change password"
> key value pair in the original event.
>
> Is this a feature or bug???
Its a feature. The only thing guaranteed by the audit system is that
name=value pairs are supported. Additional text may be there to add context
for people reading the event. But for machine parsing only name=value is
returned. So, if the additional text is needed, then either '-' or '_' can be
added between words (as many other events do).
-Steve
next prev parent reply other threads:[~2013-03-14 10:54 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-03-14 10:21 Auparse feature or bug Burn Alting
2013-03-14 10:54 ` Steve Grubb [this message]
2013-03-14 11:10 ` Burn Alting
2013-03-14 12:55 ` Steve Grubb
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2011116.HnREtfWCp5@x2 \
--to=sgrubb@redhat.com \
--cc=burn@swtf.dyndns.org \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.