Re: Events per System Call
On Monday, August 16, 2010 09:13:54 pm Steve Grubb wrote:
> If i am taking my data stream through the af_unix socket
built-in plugin
> then will i get the audit_eoe event?
For an audispd plugin, you would need to set the format parameter to
binary.
Actually, looking at the auparse library code, it looks like the EOE event
comes through in the string format, too.
-Steve