From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: PATCH: ausearch doesn't correcly act as a filter when no EOF on input Date: Tue, 18 Nov 2008 10:29:56 -0500 Message-ID: <200811181029.56205.sgrubb@redhat.com> References: <20081118001753.GA10221@suse.de> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20081118001753.GA10221@suse.de> Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Tony Jones Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Monday 17 November 2008 19:17:54 Tony Jones wrote: > Issue is that tail -f never indicates EOF and if ausearch stdout is a pipe > (versus a file), the output can remain queued in the pipebuf. The general problem is a little bigger. ausearch can't tell when an event is complete. It assumes that the kernel serializes things - which it doesn't. With files, it flushes everything when it hits EOF. But pipes don't have that. The solution I was going to implement was to start a timer when the input is a pipe and timeout the currently accumulating event. Flushing the output if using a pipe looks like a good measure, too. > Following patch fixes it, or a simpler patch could unconditionally flush > stdout. I'd rather not flush all the time otherwise the performance improvement of buffering is lost. I currently have ausearch completely tore apart to rework its event collection logic so that interlaced events are assembled correctly and completely. Maybe in a few days I can revisit this problem. > I've not looked for similar issues elsewhere. aureport shares much of the same IO design and the auparse library also does not use clock time to finish off events if the input is a pipe. -Steve