[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: Events per System Call



On Monday, August 16, 2010 09:13:54 pm Steve Grubb wrote:
> > If i am taking my data stream through the af_unix socket built-in plugin
> > then will i get the audit_eoe event?
> 
> For an audispd plugin, you would need to set the format parameter to
> binary.

Actually, looking at the auparse library code, it looks like the EOE event 
comes through in the string format, too.

-Steve


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]