Re: auparse_interpret_field()
On Friday 09 November 2007 12:15:43 klausk(a)br.ibm.com wrote:
Trying to debug this problem, I saw that it's happening because
the record
'machine' field in the auparse internal structure is set to '-1':
That would do it. Now...how did that happen? arch says its a 64 bit S390
machine.
(gdb) p *r
$17 = {
record = 0x80041510 "node=kwuser3.edincott.ibm type=SYSCALL
msg=audit(1194628042.317:58358): arch=80000016 syscall=5 success=yes
exit=3 a0=800ed250 a1=241 a2=1b6 a3=0 items=1 ppid=14670 pid=14672 auid=0
uid=0 gid=0 euid=0"..., type = 0, machine = -1, syscall = -1, a0 = 0, a1 =
0, nv = {head = 0x80039dd0, cur = 0x8002ad10,
cnt = 27}, item = 0, list_idx = 0, line_number = 19, next = 0x0}
Any chance this might be happening because I don't have the complete event
Nope, this gets pulled out of syscall records.
-Steve