Re: Kernel audit output is inconsistent, hard to parse

2008-01-29 Thread Miloslav Trmac
Hello, John Dennis napsal(a): The current formatting of the record timestamp (e.g. audit(.mmm:iii) is inconsistent with all other name/value pairs. It should be seconds=sss milliseconds=mmm serial=iii, this allows parsing to be regular and consistent. Isn't this unnecessarily verbose? Just

Re: Kernel audit output is inconsistent, hard to parse

2008-01-29 Thread John Dennis
Miloslav Trmac wrote: Hello, John Dennis napsal(a): The current formatting of the record timestamp (e.g. audit(.mmm:iii) is inconsistent with all other name/value pairs. It should be seconds=sss milliseconds=mmm serial=iii, this allows parsing to be regular and consistent. Isn't this