From mboxrd@z Thu Jan  1 00:00:00 1970
From: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com>
Subject: EOE events in auparse output
Date: Mon, 5 Dec 2016 15:00:39 +0200
Message-ID: <6ac1558f-fe8b-3e6a-decf-cdb31c180505@redhat.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; Format="flowed"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: linux-audit@redhat.com, Steven Grubb <sgrubb@redhat.com>
List-Id: linux-audit@redhat.com

Hi Steve, everyone,

I was playing with auditd and aushape on Fedora 24 and found some strange
entries in my log. There was a separate *event* produced by auparse containing
a single EOE record. These events had the same serial number as the directly
preceding events, which were exclusively containing SYSCALL records.

Those EOE records didn't appear in the audit.log file.

Is this a bug? Is this normal?

Thank you.

Nick