RE: Audit Parsing Library Requirements
I think the answer is Yes. Each state would be a search or iteration
instance.
They could be searching different files or have different search
parameters.
I think the analogy that was used previously was to think of them as "FILE
*". Using that analogy, a program can have multiple FILE *, each unique
since
they have their own fopen call which initializes the resources and state.
auparse_init would be equivalent to fopen in this analogy.
It seems that the naming is a bit confusing then. Should it be
ausearch_state_t instead of auparse_state_t, as it is setting information
related to the search. It also makes sense because ausearch_set_param()
should be setting information on a ausearch_state_t. This seems more inline
with the Ground Rules we specified.
Kevin Carr
Tresys Technology
410.290.1411 x137