From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: ENRICHED log_format not encoding all parameters Date: Thu, 20 Jul 2017 11:23:21 -0400 Message-ID: <2607478.j0y1L0nYuc@x2> References: Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com Cc: Peter KRIVANSKY List-Id: linux-audit@redhat.com T24gVGh1cnNkYXksIEp1bHkgMjAsIDIwMTcgNDowNjo0OCBBTSBFRFQgUGV0ZXIgS1JJVkFOU0tZ IHdyb3RlOgo+IEhlbGxvIHRvZ2V0aGVyLAo+IAo+IEkgYW0gd3JpdGluZyB0byB0aGlzIG1haWxp bmcgbGlzdCBhcyBJIGhhdmUgbm90IGZvdW5kIGFueSB3b3JraW5nIHNvbHV0aW9uCj4gb25saW5l Lgo+IFdlIHVzZSB0aGUgYXVkaXQgd2l0aCBFTlJJQ0hFRCBsb2dfZm9ybWF0LCBidXQgd2Ugc2Vl IGxvdHMgb2YKPiBwYXJhbWV0ZXJzIG5vdCBiZWluZyBkZWNvZGVkIGZyb20gSEVYLCBIZXJlIGFy ZSB0aGUgYXVkaXRkIHNldHRpbmdzOgoKVGhlIGRlY29kaW5nIGZyb20gaGV4IGlzIGRvbmUgYnkg YXVzZWFyY2guIEl0cyBhbHdheXMgYmVlbiBsaWtlIHRoYXQuIFdoYXQgdGhlIAplbnJpY2hlZCBm b3JtYXQgZG9lcyBpcyBjYXB0dXJlIHRoZSBlcGhlbWVyYWwgc3lzdGVtIHNwZWNpZmljIG1hcHBp bmdzIHN1Y2ggYXMgClVJRC9HSUQgYXQgdGhlIG1vbWVudCB0aGUgZXZlbnQgb2NjdXJzLiBUaGlz IHdheSB0aGUgZXZlbnRzIGNhbiBiZSBjb3JyZWN0bHkgCmRpc3BsYXllZCBieSBhdXNlYXJjaCBu byBtYXR0ZXIgd2hpY2ggY29tcHV0ZXIgeW91IHJ1biBhdXNlYXJjaCBvbi4KCgo+IGxvZ19maWxl ID0gL3Zhci9sb2cvYXVkaXQvYXVkaXQubG9nCj4gbG9nX2Zvcm1hdCA9IEVOUklDSEVECj4gbG9n X2dyb3VwID0gcm9vdAo+IHByaW9yaXR5X2Jvb3N0ID0gNAo+IGZsdXNoID0gaW5jcmVtZW50YWwK PiBmcmVxID0gNjAwMAo+IG51bV9sb2dzID0gMTAKPiBkaXNwX3FvcyA9IGxvc3N5Cj4gZGlzcGF0 Y2hlciA9IC9zYmluL2F1ZGlzcGQKPiBuYW1lX2Zvcm1hdCA9IGhvc3RuYW1lCj4gbWF4X2xvZ19m aWxlID0gMzAKPiBtYXhfbG9nX2ZpbGVfYWN0aW9uID0gUk9UQVRFCj4gc3BhY2VfbGVmdCA9IDE1 MAo+IHNwYWNlX2xlZnRfYWN0aW9uID0gU1lTTE9HCj4gYWN0aW9uX21haWxfYWNjdCA9IHJvb3QK PiBhZG1pbl9zcGFjZV9sZWZ0ID0gMTAwCj4gYWRtaW5fc3BhY2VfbGVmdF9hY3Rpb24gPSBTVVNQ RU5ECj4gZGlza19mdWxsX2FjdGlvbiA9IFNVU1BFTkQKPiBkaXNrX2Vycm9yX2FjdGlvbiA9IFNV U1BFTkQKPiB0Y3BfbGlzdGVuX3F1ZXVlID0gNQo+IHRjcF9tYXhfcGVyX2FkZHIgPSAxCj4gdGNw X2NsaWVudF9tYXhfaWRsZSA9IDAKPiBlbmFibGVfa3JiNSA9IG5vCj4ga3JiNV9wcmluY2lwYWwg PSBhdWRpdGQKPiAKPiBJbnN0YWxsZWQgYXVkaXQgVmVyc2lvbjoKPiAyLjYuNS0zLmVsN18zLjEK PiAKPiBIZXJlIHRoZSBwcm9ibGVtIHBhcnRzIG9mIHRoZSBBdWRpdCBsb2cgKHBhcmFtZXRlciBh Mik6Cj4gCj4gbm9kZT1ob3N0bmFtZS5kb21haW4udGxkIHR5cGU9RVhFQ1ZFIG1zZz1hdWRpdCgx NTAwNTM2MDkyLjMwMToyMzIxNzAyOTgpOgo+IGFyZ2M9MyBhMD0iL2Jpbi9zaCIgYTE9Ii1jIgo+ IGEyPTJGNzU3MzcyMkY2QzZGNjM2MTZDMkY2RTYxNjc2OTZGNzMyRjZDNjk2MjY1Nzg2NTYzMkY2 MzY4NjU2MzZCNUY2RTcyNzA2NQo+IDIwMkQzMjIwMkQ0ODIwMzEzMDJFMzEzMDMwMkUzMTM1MzAy RTMxMzczMjIwMkQ3MDIwMzUzNjM2MzYyMDJENjMyMDQzNjg2NTYzNkIKPiA0NjY5NkM2NTczMjAy RDc0MjAzMjMwMjAyRDYxMjA3MDYxNzQ2ODNENDYzQTJGNjM2QzY1NjE3MjY5NkU2NzJGNkQ2MzY2 NzQyRjcwCj4gNkY3MzY1Njk2NDZGNkUyRjIwNkQ2MTc4MkQ2NDY5NzIyRDY0NjU3MDc0NjgzRDMw MjA3MDYxNzQ3NDY1NzI2RTNEMkEzMzMzNUYzMAo+IDM1MzUzMDVGNEM1RjJBMkU0MzRCMzgyMDIy NjY2OTZDNzQ2NTcyM0Q3NzcyNjk3NDc0NjU2RTIwNkM3NDIwMkQzMzMwNkQyMDQxNEUKPiA0NDIw NzM2OTdBNjUyMDY3NzQyMDMxMzA2MjIyMjA0RDYxNzg0MzcyNjk3NDNEMzEKIAo+IG5vdCBkZWNv ZGVkIHBhcmFtZXRlciAoYTE0KSBpbiB0aGUgbWlkZGxlOgo+IG5vZGU9IGhvc3RuYW1lLmRvbWFp bi50bGQgIHR5cGU9RVhFQ1ZFIG1zZz1hdWRpdCgxNTAwNTM2MDkyLjMwMzoyMzIxNzAzMDApOgo+ IGFyZ2M9MTYgYTA9Ii91c3IvbG9jYWwvbmFnaW9zL2xpYmV4ZWMvY2hlY2tfbnJwZSIgYTE9Ii0y IiBhMj0iLUgiCj4gYTM9IjEwLjEwMC4wLjAiIGE0PSItcCIgYTU9IjU2NjYiIGE2PSItYyIgYTc9 IkNoZWNrRmlsZXMiIGE4PSItdCIgYTk9IjIwIgo+IGExMD0iLWEiIGExMT0icGF0aD1GOi9jbGVh cmluZy9tY2Z0L3Bvc2VpZG9uLyIgYTEyPSJtYXgtZGlyLWRlcHRoPTAiCj4gYTEzPSJwYXR0ZXJu PSozM18wNTUwX0xfKi5DSzgiCj4gYTE0PTY2Njk2Qzc0NjU3MjNENzc3MjY5NzQ3NDY1NkUyMDZD NzQyMDJEMzMzMDZEMjA0MTRFNDQyMDczNjk3QTY1MjA2Nzc0MjAzCj4gMTMwNjIgYTE1PSJNYXhD cml0PTEiCgo+IAo+IFdlIG5lZWQgRU5SSUNIRUQgbG9nX2Zvcm1hZCBzbyB3ZSBjYW4gYW5hbHl6 ZSBhdWRpdCBsb2dzIG9uIGEgY2VudHJhbCBMb2cKPiBzZXJ2ZXIuIEkgdHJpZWQgdG8gaW5jcmVh c2UgdGhlIOKAnnByaW9yaXR5X2Jvb3N04oCcIHBhcmFtZXRlciB0byA2LCBhbmQKPiBpbmNyZWFz ZWQgdGhlIOKAnmZyZXHigJwgcGFyYW0uIHRvIDYwMDAgdG8gZ2l2ZSB0aGUgYXVkaXRkIG1vcmUg dGltZSBmb3IKPiBkZWNvZGluZy4gCgpJdCBkb2Vzbid0IG5lZWQgbW9yZSB0aW1lIGFzIHRoaXMg ZG9lcyBub3QgYW55IGtpbmQgb2YgZGVhZGxpbmUgc2NoZWR1bGVyLiBJIAp3b3VsZCBob3dldmVy IHJlY29tbWVuZCB1c2luZyBpbmNyZW1lbnRhbF9hc3luYyBmb3IgdGhlIGZsdXNoIG1ldGhvZCBh cyBpdHMgCmFib3V0IDkweCBmYXN0ZXIgdGhhbiB0aGUgbm9ybWFsIGluY3JlbWVudGFsIG1ldGhv ZC4gQnV0IHRoaXMgd29uJ3QgYWZmZWN0IHRoZSAKaGV4IGVuY29kaW5nLiBUbyBzZWUgeW91ciBl dmVudCBpbiBmdWxsLCB5b3UgbmVlZCB0byBydW4gdGhlIGV2ZW50IHRocm91Z2ggCmF1c2VhcmNo LgoKCj4gTm9uZSBvZiB0aGUgbWVudGlvbmVkIGhlbHBlZC4gV2hhdCBJIGRvbuKAmXQgdW5kZXJz dGFuZCBpcyB0aGF0Cj4gc29tZXRpbWVzIGl04oCZcyB0aGUgbGFzdCBwYXJhbWV0ZXJzIHdoaWNo IGlzIG5vdCBkZWNvZGVkLCBhbmQgc29tZXRpbWVzIGl0Cj4gb25lIGluIHRoZSBtaWRkbGUuIAoK VGhlIGhleCBlbmNvZGluZyBpcyBkb25lIHdoZW5ldmVyIHRoZXJlIGlzIGEgZmllbGQgYmVpbmcg Y2FwdHVyZWQgdGhhdCBjb3VsZCAKYmUgY29udHJvbGxlZCBieSB0aGUgdXNlci4gVGhpcyBpcyB0 byBwcmV2ZW50IHNvbWVvbmUgbmFtaW5nIGEgZmlsZSB0aGF0IHdvdWxkIApjb25mdXNlIGEgbmFp dmUgcGFyc2VyIGFuZCBtYWtlIGl0IG1pc3BhcnNlIHRoZSBldmVudC4KCj4gU2VlIGV4YW1wbGUg YWJvdmUgCj4gQW55IGtpbmQgb2YgYWR2aWNlIGlzIHdlbGNvbWUKPiBXaXRoIGtpbmQgcmVnYXJk cwoKSG9wZSB0aGlzIGhlbHBzLi4uCgotU3RldmUKCi0tCkxpbnV4LWF1ZGl0IG1haWxpbmcgbGlz dApMaW51eC1hdWRpdEByZWRoYXQuY29tCmh0dHBzOi8vd3d3LnJlZGhhdC5jb20vbWFpbG1hbi9s aXN0aW5mby9saW51eC1hdWRpdA==