From mboxrd@z Thu Jan 1 00:00:00 1970 From: John Dennis Subject: Re: event loss with dispatcher? Date: Thu, 08 Nov 2007 21:20:42 -0500 Message-ID: <4733C3FA.9000005@redhat.com> References: <1194540856.19673.26.camel@klausk.br.ibm.com> <200711081234.55746.sgrubb@redhat.com> <200711081655.23068.sgrubb@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <200711081655.23068.sgrubb@redhat.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Steve Grubb Cc: "Linux-audit@redhat.com" List-Id: linux-audit@redhat.com Steve Grubb wrote: > On Thursday 08 November 2007 16:17:52 klausk@br.ibm.com wrote: >> Any tips on how can I debug this further? My apologies, but I haven't been following this thread because I've had my head down with other work, but by any chance could the missing audit data be explained by out of order event ID's in the audit stream? This was a limitation of auparse but I know Steve was planning on fixing this. If it hasn't been fixed auparse will appear to drop audit records from an event if the audit records for a single event are not contigious. Actually I think you'll get multiple copies of the same event with each copy containing only part of the audit data, a scenario that's confusing and would give the appearance of missing data. Just a thought, not sure if it's relevant. -- John Dennis