On Tuesday 09 May 2006 16:46, Linda Knippers wrote: > > The original patches by Dustin and Linda had used "new_iuid=501" to > > differentiate the values, which I personally think was fine since it's > > unlikely that people want to be searching for those. > > And if they do, they're easy to find with an ausearch | grep.
This is at the wrong level. There may be people that are writing programs that want any ouid. I want to stop the proliferation of field names and follow a convention. Forget whether or not you think people will ever want the information. We need a convention and then to follow it. > > If you absolutely want to avoid adding new tag names, an alternative > > would be to get rid of the "new " modifiers, and use the "type=" name to > > differentiate them. I don't want a proliferation of type names either. I think we have a lot of them and should try to use existing ones where possible. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
