On Tuesday 09 May 2006 11:34, Linda Knippers wrote:
If someone is looking for the records for a particular uid,
wouldn't
they expect to get the records generated by someone with that uid?
Not necessarily. I would like to present all matches of uid and let them
decide what is relavent.
> I thought it was settled at that time. If this was brought up on
the LSPP
> telecon I missed it.
It didn't seem setttled, although you were the last to reply. I think
the discussion on the LSPP list is what initiated the mail exchange.
I even updated the audit parsing specs to include all keywords:
http://people.redhat.com/sgrubb/audit/audit-parse.txt
At this point there are already a bunch of uid fields (auid, uid,
euid,
suid, fsuid, iuid, ouid) in various audit records, and a similar set
of guid files, so would you be happier with nuid, ngid, etc?
Does ouid and ogid not fit? I'd like us to define what we need in the parser
API and then use it in the audit messages. Ancilliary words like new, old,
last, first should not be tied with an underscore. If you find any, let me
know.
-Steve