[EMAIL PROTECTED] (John D. Ramsdell) writes: > I still haven't figured out why the auparse library prints getdents > when strace print getdents64.
There is no bug in auparse when it comes to printing getdents. I misread the strace output. It is printing getdents, not getdents64, just as is auparse. My strace analysis programs looked for getdents64, not getdents. I guess there was a time when the 64 bit version of the system call was in use, but it doesn't seem to be used now. John -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
