From mboxrd@z Thu Jan  1 00:00:00 1970
From: Steve Grubb <sgrubb@redhat.com>
Subject: Re: EOE events in auparse output
Date: Mon, 05 Dec 2016 10:54:30 -0500
Message-ID: <8276321.D6A7ZRxJEI@x2>
References: <6ac1558f-fe8b-3e6a-decf-cdb31c180505@redhat.com>
	<1583364.QtL6vz97jr@x2>
	<029e3140-0633-ad77-b0d9-c4af223c10d7@redhat.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <029e3140-0633-ad77-b0d9-c4af223c10d7@redhat.com>
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com>
Cc: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

On Monday, December 5, 2016 5:34:12 PM EST Nikolai Kondrashov wrote:
> However, since libauparse is supposed to provide the service of
> communicating event boundaries to its users, does it make sense for it to
> return the EOE record? Especially as a separate, empty event, which doesn't
> add any information?

I suppose it could be stripped from the event as its real purpose is locating 
the event boundary. Since I don't know if the event will be relayed on to 
another analytic processor I've just kept it there. For example, you could 
have a realtime plugin that passes its information to another process for 
correlation and escalation. In that case keeping the record makes sense. But 
for xml/json it can be dropped because it has its own way of defining an event 
boundary.

-Steve