Re: Cooked audit log format
On Mon, 2008-05-12 at 12:12 -0400, John Dennis wrote:
It should also be a goal that correct parsing of audit logs not be
dependent on specific kernel versions.
I've heard you say this a number of times. Can you let me know specific
examples of what you had to code around due to specific kernel versions
since the audit system started to settle down?
-Eric