On Tuesday, August 30, 2011 05:12:17 PM LC Bruzenak wrote: > I'm using auparse_get_field_type from the parse lib. > The return value for error is "0" which is also that of the AUDIT_PID > field. > > Right? I am getting some errors that thought they were PIDs.
That does seem to be a mistake in the API. As a workaround for this, you can check for an error with auparse_get_record_text() == NULL. I suppose I could fix the problem going forward by making auparse_get_type() return -1 on error. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
