(sorry for the html)

linux-audit-bounces@redhat.com wrote on 11/08/2007 05:26:00 PM:

> env: audit 1.6.2, s390x, RHEL5 in targeted policy, permissive mode
>
> I'm trying to assign the field name + interpreted value to a variable
> inside my dispatcher plugin. something along these lines:

Trying to debug this problem, I saw that it's happening because the record 'machine' field in the auparse internal structure is set to '-1':
(gdb) p *r
$17 = {
  record = 0x80041510 "node=kwuser3.edincott.ibm type=SYSCALL msg=audit(1194628042.317:58358): arch=80000016 syscall=5 success=yes exit=3 a0=800ed250 a1=241 a2=1b6 a3=0 items=1 ppid=14670 pid=14672 auid=0 uid=0 gid=0 euid=0"..., type = 0, machine = -1, syscall = -1, a0 = 0, a1 = 0, nv = {head = 0x80039dd0, cur = 0x8002ad10,
    cnt = 27}, item = 0, list_idx = 0, line_number = 19, next = 0x0}

Any chance this might be happening because I don't have the complete event (ie.: the CWD and PATH records are missing in the event) - In this case, this would be caused by the record loss in audispd reported in another thread...

 Klaus

--
Klaus Heinrich Kiwi/Brazil/IBM <klausk@br.ibm.com>
Software Engineer
IBM STG, Linux Technology Center
Phone:(+55-19) 2132-1909 [T/L 839-1909]