Re: event loss with dispatcher?

Steve Grubb wrote: My apologies, but I haven't been following this thread because I've had my head down with other work, but by any chance could the missing audit data be explained by out of order event ID's in the audit stream? This was a limitation of auparse but I know Steve was planning on fixing this. If it hasn't been fixed auparse will appear to drop audit records from an event if the audit records for a single event are not contigious. Actually I think you'll get multiple copies of the same event with each copy containing only part of the audit data, a scenario that's confusing and would give the appearance of missing data. Just a thought, not sure if it's relevant. -- John Dennis <jdennis(a)redhat.com&gt;