Audit Parsing Library Requirements

[Debora Velarde]

> > Since this is introducing the notion of multiple machines 
> potentially sharing 
> > the same log...would it be more clear to change the name to prevent 
> > confusion? 
> > 
> > Its currently host, but would could make it: server, node, machine, 
etc.
> 
> OK, I have a question because I think there are two issues here:
> 1) Steve has a function, called auparse_get_host, which is paralleled
> by other things like get_serial, which implies that every event has an
> associated host
> 2) This particular event has a host field, I do not think that
> auparse_get_host(0 and auparse_get_filed(au,"host") are the same

Thanks Mike.  I see my confusion now.
Since some of the records do have a field 'hostname', I favor changing
auparse_get_host to auparse_get_machine or auparse_get_node.
-debbie