From mboxrd@z Thu Jan 1 00:00:00 1970 From: AKASHI Takahiro Subject: order of entries output from ausearch -i Date: Wed, 13 Nov 2013 17:14:13 +0900 Message-ID: <528334D5.6030609@linaro.org> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; Format="flowed" Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (ext-mx11.extmail.prod.ext.phx2.redhat.com [10.5.110.16]) by int-mx01.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id rAD8EQTm023066 for ; Wed, 13 Nov 2013 03:14:26 -0500 Received: from mail-pd0-f170.google.com (mail-pd0-f170.google.com [209.85.192.170]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id rAD8EPdV029520 for ; Wed, 13 Nov 2013 03:14:26 -0500 Received: by mail-pd0-f170.google.com with SMTP id q10so69194pdj.15 for ; Wed, 13 Nov 2013 00:14:25 -0800 (PST) List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: "linux-audit@redhat.com" List-Id: linux-audit@redhat.com Hi Steve I followed your advise and verified my patch of AArch64 audit support by comparing the output from # autrace /bin/ls # ausearch -i -p XXX | grep SYSCALL with the output from # strace /bin/ls Here I found that the entries shown by "ausearch -i" are listed partially in the order of lifo (Last In First Out?). I don't think this behavior is "intuitive". (As you know, ausearch without -i generates fifo order of outputs.) Is there any good reason? Thanks, -Takahiro AKASHI