From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Hassan Sultan" Subject: multipart messages & delivery guarantees Date: Sun, 22 Feb 2015 19:15:07 -0800 Message-ID: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; Format="flowed"; DelSp="yes" Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (ext-mx16.extmail.prod.ext.phx2.redhat.com [10.5.110.21]) by int-mx13.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id t1N3EhxS026577 for ; Sun, 22 Feb 2015 22:14:44 -0500 Received: from homiemail-a52.g.dreamhost.com (sub5.mail.dreamhost.com [208.113.200.129]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id t1N3EfRI016640 for ; Sun, 22 Feb 2015 22:14:42 -0500 Received: from homiemail-a52.g.dreamhost.com (localhost [127.0.0.1]) by homiemail-a52.g.dreamhost.com (Postfix) with ESMTP id 3968B6B8303 for ; Sun, 22 Feb 2015 19:14:41 -0800 (PST) Received: from win8mac (unknown [23.252.61.230]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) (Authenticated sender: hsultan@thefroid.net) by homiemail-a52.g.dreamhost.com (Postfix) with ESMTPSA id 107696B826E for ; Sun, 22 Feb 2015 19:14:41 -0800 (PST) List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com Hi, Some events, such as execve or socket-related syscalls generate more than one message, which I'll separate as the "main" message, and then the 'sub' messages. Does the audit system guarantee in any way that user-mode will receive either no message, or all messages for a given event ? I'm curious to know if for example I could get an execve syscall message, but no cwd message, for example in case of low-memory condition. Thanks, Hassan