Re: Problems with command args

Hi I need to audit some specific commands which have the following form cmd -arg1 -arg2 -query 'some query("args")' In audit log I get a record like: type=EXECVE msg=audit(1282117611.037:27469599): argv [0] ="cmd" argv [1] ="-arg1" argv [2] ="-arg2" argv [3] ="-query" argv [4] =737472626567696E73287468726561645F69642C227468726561645F69643D32333639383932662229 Now, I'd really need to get the last query argument in an understandable form. Is this possible or is this the way it is and I can't do it?