From mboxrd@z Thu Jan 1 00:00:00 1970 From: Peng Haitao Subject: Re: [PATCH 1/2] fix a bug that use option '-r' cannot output all unformatted logs Date: Tue, 29 Jul 2008 18:07:15 +0800 Message-ID: <488EEBD3.1070504@cn.fujitsu.com> References: <488EAD35.8000404@cn.fujitsu.com> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <488EAD35.8000404@cn.fujitsu.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: sgrubb@redhat.com Cc: audit-list List-Id: linux-audit@redhat.com Hello Steve, The log which message type is CONFIG_CHANGE does not contain "auid=" and exists in /var/log/audit/audit.log, This will be OK or the log loses "auid="? If you think this is OK, I will make a new patch. Peng Haitao said the following on 2008-7-29 13:40: > Hello Steve, > > Executing command "echo 'type=CONFIG_CHANGE msg=audit(1214114026.152:1641): op=updated rules specifying path="/home/pht/source/sys_temp" with dev=4294967295 ino=4294967295 list=-672208416 res=1' | ausearch -r", the output is NULL. > The log is from /var/log/audit/audit.log and not modified. > > Signed-off-by: Peng Haitao > --- > src/ausearch-parse.c | 2 +- > 1 files changed, 1 insertions(+), 1 deletions(-) > > diff --git a/src/ausearch-parse.c b/src/ausearch-parse.c > index 141fdee..0c38be1 100755 > --- a/src/ausearch-parse.c > +++ b/src/ausearch-parse.c > @@ -1403,7 +1403,7 @@ static int parse_simple_message(const lnode *n, search_items *s) > // get loginuid > str = strstr(n->message, "auid="); > if (str == NULL) > - return 1; > + return 0; > ptr = str + 5; > term = strchr(ptr, ' '); > if (term) -- Regards Peng Haitao