On Wed, 2008-08-13 at 11:09 -0400, Eric Paris wrote: > HAHAHA, kernel output xml? dream on :) I'm willing to do > wholesale > output changes, but something that heavy in kernel is impossible to > push. I can just see Al cussing up a storm as he read that.
That's exactly my point. There's no sense in discussing a 'ideal' format for audit stream coming out of the kernel, since it's well agreed (thankfully) that the kernel part should be as minimal as possible. I like Mathew's idea of having a binary format though. Maybe it's possible to carry the legacy format for some time while we have a more robust (and extensible) binary format in parallel? And then having a binary format version tag within each record? I know I know, at the time I have more questions than answers. I only wanted to express my feeling that there is indeed a problem with the current format. I know you and Steve tried before to talk with the SELinux guys trying to have a saner format for AVCs and stuff. Do you feel that's an impossible barrier to cross or maybe we try again and convince them that stricter formatting rules will bring more users for their audit data? -Klaus -- Klaus Heinrich Kiwi <[EMAIL PROTECTED]> Linux Security Development, IBM Linux Technology Center -- Linux-audit mailing list Linux-audit@redhat.com https://www.redhat.com/mailman/listinfo/linux-audit