difficulty with TYPE
John Dennis
jdennis at redhat.com
Tue Jan 15 13:58:20 UTC 2008
James Antill wrote:
> The second iovec above can't just be MAX_AUDIT_MESSAGE_LENGTH, or if
> there are two messages you'll read some/all of the next one(s). You
> either need to read the header first and then use hdr.size, or separate
> the IO from the parsing.
> Also you can't just check for readv() as above, you need to check that
> you've read the amount of data you want, and if you didn't get it all
> yet then loop.
This is why we provide libraries to do things like this, it can be
tricky to get right. The feed() interface to auparse consumes arbitrary
amounts of data (perfect for use in select/recv calls) and then calls
back with audit events as they are recognized in the input stream you
fed it.
--
John Dennis <jdennis at redhat.com>
More information about the Linux-audit
mailing list