[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: Audit Parsing Library Requirements




Steve Grubb <sgrubb redhat com> wrote on 03/09/2006 12:59:01 PM:

> On Thursday 09 March 2006 11:48, Michael C Thompson wrote:
> > What sort of search options can you set?
>
> Oh...how about any?


Any - good to know. Sometimes people have mental models which incorperate limits which aren't clearly communicated, hence the question.

>
> > Are these basically the same that ausearch allows?
>
> We could limit it to that and it would be faster...or it could be more. Do we
> need to search on all field or just have access to all fields?


From a testing/tester standpoint, if I understand ausearc's purpose correctly, it would be nice to be able to specify and field/value pair. My understanding of auserach is to set up our search paramters (through many tedious function calls! <humor, ignore it if you don't find funny>), and then call ausearch_next_event to begin returning records which match the parameters we've set. If this is the case, from a testing standpoint, it would be nice to be able to set up the parameters on every value of the record as we expect it to look. Obviously, if this is deemed unreasonable, there are other ways to do this type of checking, but if it could be incoperated right into the library, it would decrease complexity for the caller if this is their objective.

Mike

>
> -Steve

[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]