From: Steve Grubb <sgrubb@redhat.com>
To: Joy Latten <latten@austin.ibm.com>
Cc: netdev@vger.kernel.org, linux-audit@redhat.com, davem@davemloft.net
Subject: Re: [PATCH]: revised make xfrm_audit_log more generic patch
Date: Tue, 24 Jul 2007 13:10:59 -0400 [thread overview]
Message-ID: <200707241310.59640.sgrubb@redhat.com> (raw)
In-Reply-To: <1185294806.15699.367.camel@faith.austin.ibm.com>
On Tuesday 24 July 2007 12:33:26 pm Joy Latten wrote:
> > It also wouldn't hurt to change the text being sent to this function to
> > have a hyphen instead of a space, so "SPD delete" becomes "SPD-delete".
> > This keeps the parser happy.
>
> Steve, more for my education, should all entries have this sort of
> syntax, that is, a hyphen in it?
Only if its something that is important to have associated in reports. More
that 1 or 2 hyphens is probably not good.
> I imagine some entries might be a bit more wordy and so I was wondering
> ahead of time how to do it.
The audit logs should be short as possible but contain everything necessary.
You can have language in the record that makes it more understandable for
people reading the raw record, but it won't necessarily be picked up by
report parsers for searching or presentation.
If you want me to help review the choices, let me know offline and we can work
through it.
-Steve
prev parent reply other threads:[~2007-07-24 17:10 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2007-07-23 21:46 [PATCH]: revised make xfrm_audit_log more generic patch Joy Latten
2007-07-23 22:27 ` James Morris
2007-07-24 15:04 ` Steve Grubb
2007-07-24 16:17 ` Joy Latten
2007-07-24 16:33 ` Joy Latten
2007-07-24 17:10 ` Steve Grubb [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200707241310.59640.sgrubb@redhat.com \
--to=sgrubb@redhat.com \
--cc=davem@davemloft.net \
--cc=latten@austin.ibm.com \
--cc=linux-audit@redhat.com \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).