Re: Events per System Call

Steve Grubb
2010-08-17T01:18:41Z

On Monday, August 16, 2010 09:13:54 pm Steve Grubb wrote:
> > If i am taking my data stream through the af_unix socket built-in plugin
> > then will i get the audit_eoe event?
>
> For an audispd plugin, you would need to set the format parameter to
> binary.

Actually, looking at the auparse library code, it looks like the EOE event
comes through in the string format, too.

-Steve