From mboxrd@z Thu Jan  1 00:00:00 1970
From: Eric Paris <eparis@redhat.com>
Subject: Re: aulast only displaying reboot pseudo-users
Date: Tue, 17 Jun 2014 11:26:01 -0400
Message-ID: <20140617112601.4841004e@flatline.rdu.redhat.com>
References: <20140605000405.687f6ad7@fornost.bigon.be>
	<20140617160932.1e12ac53@soldur.bigon.be>
	<20140617103125.1871abbf@flatline.rdu.redhat.com>
	<7885595.OZveFJzaAO@x2>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <7885595.OZveFJzaAO@x2>
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: Steve Grubb <sgrubb@redhat.com>
Cc: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

On Tue, 17 Jun 2014 10:56:24 -0400
Steve Grubb <sgrubb@redhat.com> wrote:

> On Tuesday, June 17, 2014 10:31:25 AM Eric Paris wrote:
> > On Tue, 17 Jun 2014 16:09:32 +0200

> > 2) Userspace silently throws records which are 'malformed' away,
> > instead of just printing them...
> > 
> > ausearch -m LOGIN should be able to display these things...
> 
> It does not have a concept of completing
> search criteria and just dumping the record out. There might be
> something that can be done here, but lots a changes risks breaking
> things in subtle ways.

I understand, but I can't imagine any customer that would want these
records silently thrown away.  When grep is a more reliable tool, we're in
trouble   :)