From mboxrd@z Thu Jan  1 00:00:00 1970
From: Steve Grubb <sgrubb@redhat.com>
Subject: Re: ausearch on aggregation - syscall difference
Date: Fri, 24 Oct 2008 14:37:18 -0400
Message-ID: <200810241437.18458.sgrubb@redhat.com>
References: <1224868121.9388.8.camel@homeserver>
	<200810241316.21804.sgrubb@redhat.com>
	<1224869269.9388.19.camel@homeserver>
Mime-Version: 1.0
Content-Type: text/plain;
  charset="utf-8"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <1224869269.9388.19.camel@homeserver>
Content-Disposition: inline
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: LC Bruzenak <lenny@magitekltd.com>
Cc: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

On Friday 24 October 2008 13:27:49 LC Bruzenak wrote:
> So it looks like the architectures interpretation (-i) of the syscall is
> where it differs?

Yes, there was a collision between the unset value and the i386 value in the 
source code. This meant that it when it ran across I386 machines, it thought 
there was an error looking it up and reverted to looking up the uname machine 
value as a fallback.  Svn commit 155 fixes this.

-Steve