From mboxrd@z Thu Jan 1 00:00:00 1970 From: Peng Haitao Subject: [PATCH 1/2] fix a bug that use option '-r' cannot output all unformatted logs Date: Tue, 29 Jul 2008 13:40:05 +0800 Message-ID: <488EAD35.8000404@cn.fujitsu.com> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Return-path: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: sgrubb@redhat.com Cc: audit-list List-Id: linux-audit@redhat.com Hello Steve, Executing command "echo 'type=CONFIG_CHANGE msg=audit(1214114026.152:1641): op=updated rules specifying path="/home/pht/source/sys_temp" with dev=4294967295 ino=4294967295 list=-672208416 res=1' | ausearch -r", the output is NULL. The log is from /var/log/audit/audit.log and not modified. Signed-off-by: Peng Haitao --- src/ausearch-parse.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/ausearch-parse.c b/src/ausearch-parse.c index 141fdee..0c38be1 100755 --- a/src/ausearch-parse.c +++ b/src/ausearch-parse.c @@ -1403,7 +1403,7 @@ static int parse_simple_message(const lnode *n, search_items *s) // get loginuid str = strstr(n->message, "auid="); if (str == NULL) - return 1; + return 0; ptr = str + 5; term = strchr(ptr, ' '); if (term) -- 1.5.4.2 -- Regards Peng Haitao