On Wed, Sep 18, 2013 at 10:25:57AM -0400, Steve Grubb wrote:
On Tuesday, September 17, 2013 10:25:23 PM Richard Guy Briggs wrote:
> On Tue, Sep 17, 2013 at 02:10:19PM -0400, Steve Grubb wrote:
> > and then session information:
> > audit_log_format(ab, " auid=%u ses=%u\n", auid, sessionid);
> > which is 32 characters...but I don't know why the \n is in there. That
> > should probably be deleted!!
>
> That is unexpected... added in 4d3fb709 when the session id was
> refactored (by eparis(a)localhost.localdomain nonetheless!). auditd seems
> to be doing the right thing when writing out /var/log/audit/audit.log
> though.
Please drop the '\n' as I mentioned above. It doesn't belong there and wastes
room in the audit trail. Auditd strips all '\n' and it would run faster if it
didn't have to strip it out.
Yup, I'll do that...
-Steve
- RGB
--
Richard Guy Briggs <rbriggs(a)redhat.com>
Senior Software Engineer
Kernel Security
AMER ENG Base Operating Systems
Remote, Ottawa, Canada
Voice: +1.647.777.2635
Internal: (81) 32635
Alt: +1.613.693.0684x3545