Re: PATCH: ausearch doesn't correcly act as a filter when no EOF on input
On Monday 17 November 2008 19:17:54 Tony Jones wrote:
Issue is that tail -f never indicates EOF and if ausearch stdout is a
pipe
(versus a file), the output can remain queued in the pipebuf.
The general problem is a little bigger. ausearch can't tell when an event is
complete. It assumes that the kernel serializes things - which it doesn't.
With files, it flushes everything when it hits EOF. But pipes don't have
that. The solution I was going to implement was to start a timer when the
input is a pipe and timeout the currently accumulating event. Flushing the
output if using a pipe looks like a good measure, too.
Following patch fixes it, or a simpler patch could unconditionally
flush
stdout.
I'd rather not flush all the time otherwise the performance improvement of
buffering is lost. I currently have ausearch completely tore apart to rework
its event collection logic so that interlaced events are assembled correctly
and completely. Maybe in a few days I can revisit this problem.
I've not looked for similar issues elsewhere.
aureport shares much of the same IO design and the auparse library also does
not use clock time to finish off events if the input is a pipe.
-Steve