Eric Paris wrote:
On Thu, 2008-08-07 at 12:50 +0800, Chu Li wrote:
> Hi Steve,
> When auditd is stoped, "auditctl -s" will show "pid=0". I think
it's not
> correct information. It's better to tell users "auditd not started".
>
We do try to keep the whole key=value pair thing in audit records. I'd
be willing to go with something like -1 to make it really clear, but
with the number of complaints about the inconsistencies of audit records
from people like John Dennis I'm not sure I'm a fan of this patch....
Thank you Eric! We should be moving toward consistent formatting of
audit records and one of the most important consistencies to achieve if
we do modify the records is that all data is in the form of key=value.
Embedding random strings into records makes parsing difficult especially
when the record format varies by kernel version, which this patch would
do (at least the proposed string didn't contain any embedded spaces!)
NAK to this patch.
I think Eric's suggestion of pid=-1 is a good one.
--
John Dennis <jdennis(a)redhat.com>