Re: [redhat-lspp] Initial CUPS auditing patch

On Monday 22 August 2005 13:39, Matt Anderson wrote: Admittedly, I haven't reviewed this patch to see all the audit messages. But, I'd like to keep the text as short as possible. We basically need the operation, who did it, to what, and the outcome. I also need it to be easy to parse so that you can run ausearch against it and find the unsuccessful attempts. A good example of what I mean is the shadow-utils code. I created a generic logging function that you filled in the necessary parts and it formated the message so that it could be easily parsed. I will probably extend this generic logger function to libaudit so there is a standard format. This will make life easier if we move to a binary format, too. We can revisit the audit parts of this patch as we get new audit code in place. Please don't get too hung up on exact wording at this minute - it will likely need to change for some reason. -Steve