Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

BUG: skeleton.c handler example should mention it requires binary format + add doc for code format = string mode #24

Open
sgpinkus opened this issue Nov 19, 2020 · 2 comments

Comments

@sgpinkus
Copy link

sgpinkus commented Nov 19, 2020

Please update text in the wiki surrounding the skeleton.c example audispd listener here, to mention it only works correctly plugin conf format set to "binary". The default value is "string".

A note on how data is passed to listeners when format is "string" would also be helpful here. Specifically:

  • assert no header is sent
  • records are newline terminated, so i.e. it's essentially equivalent to tailing the audit.log.
  • clarify guarantees or lack there of about how multi record (line) events are delivered - are they guaranteed to be contiguous? Are they always available all at once without blocking?
@sgpinkus sgpinkus changed the title Docs :: skeleton.c handler example should mention it's requires binary format Docs :: skeleton.c handler example should mention it requires binary format Nov 19, 2020
@pcmoore pcmoore changed the title Docs :: skeleton.c handler example should mention it requires binary format BUG: skeleton.c handler example should mention it requires binary format Nov 19, 2020
@pcmoore
Copy link
Contributor

pcmoore commented Nov 19, 2020

Let's bring this to @stevegrubb's attention.

@sgpinkus sgpinkus changed the title BUG: skeleton.c handler example should mention it requires binary format BUG: skeleton.c handler example should mention it requires binary format + add doc for code format = string mode Nov 22, 2020
@stevegrubb
Copy link

With the audit-3.0 design, there is no separate audispd. Everything now is a plugin to auditd. With that change, skeleton.c has been dropped from the codebase. This happened over a year ago.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants