From mboxrd@z Thu Jan  1 00:00:00 1970
From: Steve Grubb <sgrubb@redhat.com>
Subject: Re: [PATCH] audit: use audit_log_task_info in audit_core_dumps and
	__audit_seccomp
Date: Tue, 14 Jan 2014 09:48:36 -0500
Message-ID: <1840642.Kpxqik9TDB@x2>
References: <1389668195-25196-1-git-send-email-eparis@redhat.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <1389668195-25196-1-git-send-email-eparis@redhat.com>
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: Eric Paris <eparis@redhat.com>
Cc: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

On Monday, January 13, 2014 09:56:35 PM Eric Paris wrote:
> It seems that reusing the task info pattern throughout records should
> allow for faster simpler more streamlined userspace records parsing, but
> changing order like this might be a deal breaker.

Have you tried using the ausearch test suite? I published it so that it can be 
found out what all these patches will do to the stability of user space. I'd 
delete your logs, reboot into test kernel, generate as many kind of events as 
possible, then extract the logs and test with the test suite.

-Steve