Re: [RFC][PATCH] audit: log join and part events to the read-only multicast log socket

> > But it illustrates the point. There are tools that depend on an ordering and > > format. There are more programs that just ausearch that needs to be > > considered if the fields change. For example, Someone could do things like > > this: > > > > retval = auparse_find_field(au, "auid"); > > retval = auparse_next_field(au); > > retval = auparse_next_field(au); > > retval = auparse_find_field(au, res"); > > > > Where, if the field ordering can't be guaranteed, the code becomes: > > > > retval = auparse_find_field(au, "auid"); > > retval = auparse_first_field(au); > > retval = auparse_find_field(au, "pid"); > > retval = auparse_first_field(au); > > retval = auparse_find_field(au, "uid"); > > retval = auparse_first_field(au); > > retval = auparse_find_field(au, res"); In my mind the latter code is more robust and preferable.