Miloslav Trmac wrote:
Hello,
audit_log_acct_message() is currently quoting acct differently from all
other users: it adds quotes to acct if it is represented in hexadecimal,
not when it is represented as-is.
This isn't the only audit hexadecimal parsing issue, there are many
more, see my previous posts. It is a sad fact audit output is impossible
to parse correctly given only the output. Correct parsing of audit data
demands private knowledge about the format of audit log messages on a
per kernel version basis, this is very broken IMHO.
--
John Dennis <[EMAIL PROTECTED]>
--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
