From mboxrd@z Thu Jan 1 00:00:00 1970 From: Burn Alting Subject: Re: Patch to auparse to handle out of order messages 2 of 3 Date: Thu, 07 Jan 2016 08:24:15 +1100 Message-ID: <1452115455.26850.93.camel@swtf.swtf.dyndns.org> References: <1452076194.26850.88.camel@swtf.swtf.dyndns.org> <3311155.vSfdxMiWeB@x2> Reply-To: burn@swtf.dyndns.org Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <3311155.vSfdxMiWeB@x2> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Steve Grubb Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com Noted .. old habits ... I've always ifdef'd new code effecting a core element of a capability and remove it a release or two later. On Wed, 2016-01-06 at 10:45 -0500, Steve Grubb wrote: > On Wednesday, January 06, 2016 09:29:54 PM Burn Alting wrote: > > #2 - the 'lol' patch itself. Integrate the ausearch/aureport 'lol' code > > into auparse() and adjust auparse() to deal with maintain an incore list > > of incomplete events. > > Quick question...there is this: > > #define LOL_EVENTS 1 > > Couldn't we just assume that this is desired and get rid of all the #ifdefs? > (You don't need to re-send the patch.) Ideally I would like everyone running > the same code for support purposes. > > -Steve