You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Please update text in the wiki surrounding the skeleton.c example audispd listener here, to mention it only works correctly plugin conf format set to "binary". The default value is "string".
A note on how data is passed to listeners when format is "string" would also be helpful here. Specifically:
assert no header is sent
records are newline terminated, so i.e. it's essentially equivalent to tailing the audit.log.
clarify guarantees or lack there of about how multi record (line) events are delivered - are they guaranteed to be contiguous? Are they always available all at once without blocking?
The text was updated successfully, but these errors were encountered:
sgpinkus
changed the title
Docs :: skeleton.c handler example should mention it's requires binary format
Docs :: skeleton.c handler example should mention it requires binary format
Nov 19, 2020
pcmoore
changed the title
Docs :: skeleton.c handler example should mention it requires binary format
BUG: skeleton.c handler example should mention it requires binary format
Nov 19, 2020
sgpinkus
changed the title
BUG: skeleton.c handler example should mention it requires binary format
BUG: skeleton.c handler example should mention it requires binary format + add doc for code format = string mode
Nov 22, 2020
With the audit-3.0 design, there is no separate audispd. Everything now is a plugin to auditd. With that change, skeleton.c has been dropped from the codebase. This happened over a year ago.
Please update text in the wiki surrounding the skeleton.c example audispd listener here, to mention it only works correctly plugin conf
format
set to "binary". The default value is "string".A note on how data is passed to listeners when format is "string" would also be helpful here. Specifically:
The text was updated successfully, but these errors were encountered: