Re: difficulty with TYPE
On Tuesday 15 January 2008 08:33:59 James Antill wrote:
> /* Get header first. it is fixed size */
> vec[0].iov_base = (void*)&hdr;
> vec[0].iov_len = sizeof(hdr);
>
> // Next payload
> vec[1].iov_base = data;
> vec[1].iov_len = MAX_AUDIT_MESSAGE_LENGTH;
>
> rc = readv(pipe_fd, vec, 2);
> if (rc == 0 || rc == -1) {
The second iovec above can't just be MAX_AUDIT_MESSAGE_LENGTH, or if
there are two messages you'll read some/all of the next one(s).
I am fixing the example code to match the code in 1.6.5's audispd program. The
example code was included 2 years ago before we had a working audispd program
so that people that were ambitious could write their own. At this point,
audispd is working and people can just code plugins which auparse does work
with when the string mode is selected for output format. See the audispd man
page for more info.
-Steve