From mboxrd@z Thu Jan 1 00:00:00 1970 From: LC Bruzenak Subject: Re: Performance of libauparse Date: Wed, 01 Oct 2008 14:31:48 -0500 Message-ID: <1222889508.15037.117.camel@homeserver> References: <48E22AC8.8010906@redhat.com> <48E27B7E.3050000@redhat.com> <1222866927.28251.115.camel@localhost.localdomain> <200810011438.17154.paul.moore@hp.com> <1222888813.15037.111.camel@homeserver> Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Return-path: Received: from mx3.redhat.com (mx3.redhat.com [172.16.48.32]) by int-mx1.corp.redhat.com (8.13.1/8.13.1) with ESMTP id m91JW7oo026189 for ; Wed, 1 Oct 2008 15:32:08 -0400 Received: from mail.magitekltd.com (rrcs-24-242-137-197.sw.biz.rr.com [24.242.137.197]) by mx3.redhat.com (8.13.8/8.13.8) with ESMTP id m91JVn7L020935 for ; Wed, 1 Oct 2008 15:31:49 -0400 Received: from [24.242.137.194] (helo=[192.168.30.40]) by mail.magitekltd.com with esmtpsa (TLS-1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.63) (envelope-from ) id 1Kl7PJ-0007GX-Tf for linux-audit@redhat.com; Wed, 01 Oct 2008 14:30:45 -0500 In-Reply-To: <1222888813.15037.111.camel@homeserver> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com Oh, another thing which would (potentially) get harder is aggregation. Since we have aggregated audit data sent from one audisp-remote to the event loop of the aggregating auditd, both systems (kernels) would need to be on the same data format page. Otherwise, the formats would be interwoven in the same on-disk log. LCB. -- LC (Lenny) Bruzenak lenny@magitekltd.com