----- Original Message ----- > It might still be an idea to have auparse_get_uid(au) etc.
I'm not 100% sure what you mean, but is perhaps auparse_interpret_field what
you are looking for? It returns an "intepreted" (as opposed to "raw") version
of the field, e.g. a name instead of an UID.
Mirek
--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
