[PATCH] Handle timestamp 0.0 in auparse, was Re: audit-viewer help needed

Hello, the attached patch modifies auparse not to handle timestamp 0.x specially by using out-of-band information (parse_state == EVENT_EMPTY) instead of assuming (au->le.e.sec == 0) has a special meaning. As far as I can see, this the two conditions are equivalent if no event has a timestamp 0.x. The patch also decreases the assumed minimal length of a timestamp. I have tested this only minimally - I have checked that (make check) succeeds, and that audit-viewer doesn't crash on startup. This patch fixes handling of the following Lenny's audit record: I'm curious how this audit record could have been created (notabile is that the previous record has a sequence ID 6758 and a reasonable timestamp). Lenny, Steve, any ideas? Thank you, Mirek