auparse question

Miloslav Trmač mitr at redhat.com
Fri Jun 6 19:36:41 UTC 2008


LC Bruzenak píše v Pá 06. 06. 2008 v 14:20 -0500:
> I send in my own n=v pairs.
> The auparse library code returns all the name elements but on a string
> value with embedded spaces it stops at the first space.
<snip>
> I read through most of the list entries regarding this and also Steve's
> auparse text page and I must be missing the answer; apology in advance
> since after reading through most of the replies I realized it has been
> discussed thoroughly, but I do not see the answer.
There's no answer.  auparse (except for some special cases) splits
fields at spaces.

One usual way of handling spaces is to use the hex-encoded form for
field representation, and decode it either using
auparse_interpret_field() (which hard-codes the ways to decode specific
field types, and does nothing for unknown types), or in the application.
The other usual way of handling spaces is to just write them in the
record and let the applications deal with them however they want (you
can get the raw record text out of auparse, after all).

I plan to make auparse more useful in this regard, but the best I can
hope for is adding more special cases for specific field and record
types.  A long-term, future-proof solution must involve some changes to
the record format definition.
	Mirek




More information about the Linux-audit mailing list