From mboxrd@z Thu Jan  1 00:00:00 1970
From: Eric Paris <eparis@redhat.com>
Subject: Re: [PATCH] Fix acct quoting in audit_log_acct_message())
Date: Tue, 04 Mar 2008 15:43:23 -0500
Message-ID: <1204663403.3216.126.camel@localhost.localdomain>
References: <47CCC6F0.1090005@redhat.com> <47CD65A3.8020204@redhat.com>
	<1204654248.12783.32.camel@vespa.frost.loc>
	<200803041356.19571.sgrubb@redhat.com>  <47CDB116.7010007@redhat.com>
Mime-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <47CDB116.7010007@redhat.com>
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: John Dennis <jdennis@redhat.com>
Cc: linux-audit@redhat.com
List-Id: linux-audit@redhat.com


On Tue, 2008-03-04 at 15:29 -0500, John Dennis wrote:
> Steve Grubb wrote:
> >  If there's no agreement with them, should we change anything? 
> > auparse is working pretty good as is.
> 
> No it's not. The auparse approach is based on tables, tables which have 
> been shown to be incorrect and tied to kernel versions and the patch set 
> used to build that kernel version.

Can you show some example of which kernels had one thing and which
kernels another?  Can you also show patch (I assume you mean a RHEL5
patch) sets on top of kernels which changed things so that 2 kernels
would have conflicting output?  Hopefully this will help me understand
and address your concerns.

-Eric