On Wednesday 14 June 2006 08:41, Steve wrote: > So, is there a way to tell when all messages for a particular event have > been dispatched?
This was recently discussed on the list. All the records for the same event come out one after another. There is a chance that some other event may sneak in during the dump. But you can pretty well assume that if there are no more records emitted with the same serial number/time stamp within 2-3 seconds, you have a complete event. > Also, is it safe to assume a type 1300 message is always the first > message pertaining to a rule violation? Maybe not. I'd not make that assumption just to be safe. Collect the full event's information, then look at the message types. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
