auparse_interpret_field()

[Klaus Heinrich Kiwi <klausk@br.ibm.com>]

env: audit 1.6.2, s390x, RHEL5 in targeted policy, permissive mode

I'm trying to assign the field name + interpreted value to a variable
inside my dispatcher plugin. something along these lines:

do {
    name = auparse_get_field_name(au);
    value = auparse_interpret_field(au);
    snprintf(data, 1023, "%s=%s", name, value);
} while (auparse_next_record(au) > 0);

but auparse is failing to interpret fields like arch and syscall. From
gdb:
(gdb) p name
$20 = 0x80037bd0 "arch"
(gdb) printf "%s\n",auparse_get_field_str(au)
80000016
(gdb) printf "%s\n",auparse_interpret_field(au)
unknown elf type(80000016)
---
(gdb) p name
$22 = 0x80037b90 "syscall"
(gdb) p auparse_get_field_str(au)
$23 = 0x8002acf0 "5"
(gdb) p auparse_interpret_field(au)
$24 = 0x8002ade0 "unknown syscall(-1)"


uid and auid are being correctly translated (at least for root). No AVCs
seen.

Am I missing something?

 Thanks,

 Klaus