From mboxrd@z Thu Jan 1 00:00:00 1970 From: Nikolai Kondrashov Subject: Re: EOE events in auparse output Date: Mon, 5 Dec 2016 18:49:43 +0200 Message-ID: <85652f90-4860-7c8f-1b2f-7579a00075a7@redhat.com> References: <6ac1558f-fe8b-3e6a-decf-cdb31c180505@redhat.com> <1583364.QtL6vz97jr@x2> <029e3140-0633-ad77-b0d9-c4af223c10d7@redhat.com> <8276321.D6A7ZRxJEI@x2> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; Format="flowed" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <8276321.D6A7ZRxJEI@x2> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Steve Grubb Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On 12/05/2016 05:54 PM, Steve Grubb wrote: > On Monday, December 5, 2016 5:34:12 PM EST Nikolai Kondrashov wrote: >> However, since libauparse is supposed to provide the service of >> communicating event boundaries to its users, does it make sense for it to >> return the EOE record? Especially as a separate, empty event, which doesn't >> add any information? > > I suppose it could be stripped from the event as its real purpose is locating > the event boundary. Since I don't know if the event will be relayed on to > another analytic processor I've just kept it there. For example, you could > have a realtime plugin that passes its information to another process for > correlation and escalation. In that case keeping the record makes sense. Hmm, perhaps, but I think it's not a useful feature, and a rather confusing one. I think there aren't many actual use cases between simply passing the raw log, and passing what was parsed with auparse, in whatever shape, and had event boundaries explicitly defined already. However, I'd leave this up to you. > But for xml/json it can be dropped because it has its own way of defining an > event boundary. Yes, I can implement dropping it. Thanks! Nick