kunal chandarana wrote:
> data="type=USER_ACCT msg=audit(1200638450.722:15): user pid=2156
uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023
msg='op=PAM:accounting acct=root exe=\"/usr/sbin/gdm-binary\"
(hostname=?, addr=?, terminal=:0 res=success)'\0";
There is no EOR (End of Record) character in your data (e.g. newline),
therefore the record is not terminated and the input is incomplete.
The EOR is *not* implicit at EOB (End of Buffer) because buffers can be
concatenated fragments.
--
John Dennis <[EMAIL PROTECTED]>
--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
