From mboxrd@z Thu Jan 1 00:00:00 1970 From: John Dennis Subject: Re: comparing record ids in auparse Date: Wed, 05 Sep 2007 12:37:08 -0400 Message-ID: <1189010228.15928.19.camel@junko.usersys.redhat.com> References: <1189008706.15928.12.camel@junko.usersys.redhat.com> <200709051223.59958.sgrubb@redhat.com> Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <200709051223.59958.sgrubb@redhat.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Steve Grubb Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Wed, 2007-09-05 at 12:23 -0400, Steve Grubb wrote: > On Wednesday 05 September 2007 12:11:46 John Dennis wrote: > > Should two different events from two different hosts be comparable? > > In a consolidated log, they are not equal. I suppose that should be fixed in > the next release. Right, but the way the cmp operator works is if it's not equal it's either less than or greater than, neither of which is meaningful as a result if they are not from the same host, right? Currently the API does not support a way to return an error code for the compare function, but it's an error to compare two records who do not share the same host value. At the moment all I can think of is that auparse_timestamp_compare() will have to be deprecated and replaced with a different function, unless you have a better idea. Suggestions? -- John Dennis