Auparse feature or bug
Hi,
When the auparse library parses certain USER_* type events it appears to
have an issue key values with embedded spaces. For example, the event
type=USER_CHAUTHTOK msg=audit(1363256032.497:202603): user
pid=24180 uid=0 auid=500 ses=1 msg='op=change password id=500
exe="/usr/bin/passwd" hostname=? addr=? terminal=pts/1
res=success'
when parsed using the code identified in auparse_feed(1), will result in
event: 1
records:1
fields:12
type=1108 event time: 1363256032.497:202603
type=USER_CHAUTHTOK (USER_CHAUTHTOK)
pid=24180 (24180)
uid=0 (root)
auid=500 (burn)
ses=1 (1)
op=change (change)
id=500 (burn)
exe="/usr/bin/passwd" (/usr/bin/passwd)
hostname=? (?)
addr=? (?)
terminal=pts/1 (pts/1)
res=success (success)
As you can see, we have lost the 'password' element of the
"op=change password"
key value pair in the original event.
Is this a feature or bug???
Regards
Burn
Regards
Burn Alting