Re: Patch to auparse to handle out of order messages 3 of 3

On Thu, 2016-01-07 at 22:06 -0500, Paul Moore wrote: This is just a request to the kernel audit team, to note that the user level audit capability is making use of the AUDIT_PROCTITLE record to be an end of event marker. If you believe this is an unacceptable risk for downstream processing, then we can take this out and hence withdraw the request. The alternative is to maintain status quo, and/or optionally emit the AUDIT_EOE record into the stored audit and be done with it, and accept the storage cost. I wholeheartedly agree about the challenges we have with respect to the current format of the audit events emitted by the kernel. I spend a lot of effort converting the unstructured, sometimes inconsistently displayed events into more structured data. I believe the way forward is to define a more correct, efficient AND extensible output form for the kernel. On the user space side, we assist the existing consumers of our audit data (our customers so to speak) by providing a legacy audispd plugin to take the 'refined' data and format it into the current 'mash-up'. To assist this interim measure/plugin, and state that is IS interim, when converting the kernel code to emit a record, ensure our new method can record the old/legacy format in some way. The legacy formatting should be able to be compiled out. Like Paul, I don't like being 'forced' to keep bugs in place within a data source because those downstream don't want to sustain their data consumption capability.