On Tue, 07 Oct 2014 20:31:30 +1100 Burn Alting <[email protected]> wrote: > This patch prevents ausearch from parsing an event's "header" of node, > type, time and serial twice. That is > [node=<node>] type=<type> msg=audit(<epochsecs>.<msecs>:<serial>) > > It does this by passing the llist->e value to > output_interpreted_node() as this structure holds the already parsed > event "header" information. > > The code does not change the ausearch -i output.
Thanks for the patch. I've applied it locally and it seems to work fine. Will commit it as soon as I can. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
