user message limits

[LC Bruzenak]

I know I can go look at the code, however I figured I'd ask here first
about the limits on the user message in both audit_log_user_message and
ausearch.

With audit_log_user_message the maximum length allowed appears to be
around MAX_AUDIT_MESSAGE_LENGTH-100. I think it may depend on the
executable name length (and other stuff auto-pushed into the string)
which is why I say "around".

Even when I get a successful return value (from audit_log_user_message),
I don't get my string back out in "ausearch" unless it is WAY smaller -
~1K or less I think.

Any ideas/thoughts?

This is the latest (1.7.11-2) audit package.

Thx,
LCB.

-- 
LC (Lenny) Bruzenak
lenny at magitekltd.com