Re: [PATCH] Fix acct quoting in audit_log_acct_message())

Eric Paris
2008-03-04T20:43:23Z

On Tue, 2008-03-04 at 15:29 -0500, John Dennis wrote:
> Steve Grubb wrote:
> > If there's no agreement with them, should we change anything?
> > auparse is working pretty good as is.
>
> No it's not. The auparse approach is based on tables, tables which have
> been shown to be incorrect and tied to kernel versions and the patch set
> used to build that kernel version.

Can you show some example of which kernels had one thing and which
kernels another? Can you also show patch (I assume you mean a RHEL5
patch) sets on top of kernels which changed things so that 2 kernels
would have conflicting output? Hopefully this will help me understand
and address your concerns.

-Eric