From mboxrd@z Thu Jan 1 00:00:00 1970 From: Satish Chandra Kilaru Subject: Getting events on unix socket Date: Wed, 29 Jul 2015 14:29:23 -0400 Message-ID: Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============3973510465121212275==" Return-path: Received: from mx1.redhat.com (ext-mx04.extmail.prod.ext.phx2.redhat.com [10.5.110.28]) by int-mx13.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id t6TITikW007471 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO) for ; Wed, 29 Jul 2015 14:29:44 -0400 Received: from mail-ig0-f174.google.com (mail-ig0-f174.google.com [209.85.213.174]) by mx1.redhat.com (Postfix) with ESMTPS id F16B91390F for ; Wed, 29 Jul 2015 18:29:43 +0000 (UTC) Received: by igr7 with SMTP id 7so151938463igr.0 for ; Wed, 29 Jul 2015 11:29:43 -0700 (PDT) List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: "linux-audit@redhat.com" List-Id: linux-audit@redhat.com --===============3973510465121212275== Content-Type: multipart/alternative; boundary=047d7bdc14a6416232051c07c5f7 --047d7bdc14a6416232051c07c5f7 Content-Type: text/plain; charset=UTF-8 I would like to receive events on unix socket in binary format. There is already another program that is reading events from unix socket in string format. I created another config file as below... active = yes direction = out path = builtin_af_unix type = builtin args = 0640 /var/run/satish_events format = binary In my test program I am reading events from the socket /var/run/satish_events Surprisingly I see events in string format as well as binary format. Is it by design or a bug? -- Please Donate to www.wikipedia.org --047d7bdc14a6416232051c07c5f7 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
I would like to receive events on unix socket in binary fo= rmat.
There is already another program that is reading events from unix= socket in string format.
I created another config file as below.= ..

active =3D yes
direction =3D out=
path =3D builtin_af_unix
type =3D builtin
ar= gs =3D 0640 /var/run/satish_events
format =3D binary
In my test program I am reading events from the socket /var/ru= n/satish_events
Surprisingly I see events in string format as well as bi= nary format.

Is it by design or a bug?
-= -=C2=A0
Please Donate to www.wikipedia.org
--047d7bdc14a6416232051c07c5f7-- --===============3973510465121212275== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============3973510465121212275==-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: Getting events on unix socket Date: Thu, 30 Jul 2015 11:51:15 -0400 Message-ID: <5598992.dAmjx71Ayh@x2> References: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Wednesday, July 29, 2015 02:29:23 PM Satish Chandra Kilaru wrote: > I would like to receive events on unix socket in binary format. > There is already another program that is reading events from unix socket in > string format. I created another config file as below... > > active = yes > direction = out > path = builtin_af_unix > type = builtin > args = 0640 /var/run/satish_events > format = binary > > In my test program I am reading events from the socket > /var/run/satish_events > Surprisingly I see events in string format as well as binary format. > > Is it by design or a bug? I'd have to check. I don't think it was intended to run more than one instance. What is better, though, is to write the plugin to just read stdin. -Steve From mboxrd@z Thu Jan 1 00:00:00 1970 From: Satish Chandra Kilaru Subject: Re: Getting events on unix socket Date: Thu, 30 Jul 2015 11:58:39 -0400 Message-ID: References: <5598992.dAmjx71Ayh@x2> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============8443179718321538911==" Return-path: In-Reply-To: <5598992.dAmjx71Ayh@x2> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Steve Grubb Cc: "linux-audit@redhat.com" List-Id: linux-audit@redhat.com --===============8443179718321538911== Content-Type: multipart/alternative; boundary=001a113f97d8fad89b051c19c70b --001a113f97d8fad89b051c19c70b Content-Type: text/plain; charset=UTF-8 Thank you. reading from stdin works. However, my program runs as a thread in a daemon that does many other things. I cannot use stdin. --Satish On Thu, Jul 30, 2015 at 11:51 AM, Steve Grubb wrote: > On Wednesday, July 29, 2015 02:29:23 PM Satish Chandra Kilaru wrote: > > I would like to receive events on unix socket in binary format. > > There is already another program that is reading events from unix socket > in > > string format. I created another config file as below... > > > > active = yes > > direction = out > > path = builtin_af_unix > > type = builtin > > args = 0640 /var/run/satish_events > > format = binary > > > > In my test program I am reading events from the socket > > /var/run/satish_events > > Surprisingly I see events in string format as well as binary format. > > > > Is it by design or a bug? > > I'd have to check. I don't think it was intended to run more than one > instance. What is better, though, is to write the plugin to just read > stdin. > > -Steve > -- Please Donate to www.wikipedia.org --001a113f97d8fad89b051c19c70b Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Thank you.
reading from stdin works. However, my= program runs as a thread in a daemon that does many other things. I cannot= use stdin.

--Satish

On Thu, Jul 30, 2015 at 11:51 AM, Steve G= rubb <sgrubb@redhat.com> wrote:
On Wednesday, July 29, 2015 02:29:23 PM Satish Chand= ra Kilaru wrote:
> I would like to receive events on unix socket in binary format.
> There is already another program that is reading events from unix sock= et in
> string format. I created another config file as below...
>
> active =3D yes
> direction =3D out
> path =3D builtin_af_unix
> type =3D builtin
> args =3D 0640 /var/run/satish_events
> format =3D binary
>
> In my test program I am reading events from the socket
> /var/run/satish_events
> Surprisingly I see events in string format as well as binary format. >
> Is it by design or a bug?

I'd have to check. I don't think it was intended to run more= than one
instance. What is better, though, is to write the plugin to just read stdin= .

-Steve



--
Please Donate to www.wikipedia.org
--001a113f97d8fad89b051c19c70b-- --===============8443179718321538911== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============8443179718321538911==--