Re: auparse_feed callback on EOE record

[Steve Grubb <sgrubb@redhat.com>]

On Tuesday, June 11, 2019 2:56:23 AM EDT Tarun Ramesh wrote:
> The callback function on_audit_event() just goes through the records one by
> one and prints the fields and values. I have added a rule to watch for
> file edits in the /home folder. I see the records for file creation in
> this folder being received, however it looks like the callback function is
> not being called when an EOE record is received. Please let me know if I'm
> missing something.

As long as the format exactly matched how auditd creates the record, cursory 
glance appears ok, then the records get grouped inside auparse to form a 
complete event. When the event is determined to be complete, it is passed to 
the registered callback function. You need to iterate over the individual 
records to see the whole event. 

So, you do not get a callback on an individual record, you are called back on 
a complete event. The EOE record should be the last record. You can use 
auparse_next_record() to iterate across records.

-Steve