Re: Refactoring src/ausearch-report.c:output_interpreted_node()

On Wed, 2014-10-01 at 14:54 -0400, Steve Grubb wrote: > > I am uncertain what effect of accepting this additional format would > > have when adding rules to the running audit system - i.e. > > audit_name_to_msg_type() is called by autrace/auditctl when parsing > > rules (ie the msgtype field name). > > I think ausearch-report.c might be the place that needs updating. So, could we modify output_interpreted_node() to no longer re-parse the [node=<node>] type=<type> msg=audit(<epochsecs>.<msecs>:<serial>) header and pass both the lnode and llist->e which has this data already as the code if (num == -1) { // see if we are older and wiser now. bptr = strchr(str, '['); if (bptr && bptr < ptr) { char *eptr; bptr++; eptr = strchr(bptr, ']'); if (eptr) { *eptr = 0; errno = 0; num = strtoul(bptr, NULL, 10); *eptr = ']'; if (errno) num = -1; } } } which parses for type=.*[n].* is no longer needed as we don't have that format any more?