On Mon, 1 Feb 2016 13:48:42 +0200 Lev Stipakov <lstipa...@gmail.com> wrote:
> Hi, > > I have a Debian 7.9 which includes libaudit-devel-1.7.18. That > version does not have auparse_feed_has_data(). Its implementation > looks simple, however it uses au_lo, which is declared as static in > auparse.c and therefore cannot be accessed outside of that file. > > I took auparse_feed_has_data() usage from audisp-example.c > > tv.tv_sec = 5; > tv.tv_usec = 0; > FD_ZERO(&read_mask); > FD_SET(0, &read_mask); > if (auparse_feed_has_data(au)) > retval= select(1, &read_mask, NULL, NULL, &tv); > else > retval= select(1, &read_mask, NULL, NULL, NULL); > > I noticed that old version of example plugin doesn't have > auparse_feed_has_data() or select() calls > (https://github.com/gdestuynder/audit-cef/blob/master/contrib/plugin/audisp-example.c#L104) > > What is the purpose of select/auparse_feed_has_data? Is it some kind > of optimization or bug fix? A little of both. See this thread for the background: https://www.redhat.com/archives/linux-audit/2012-August/msg00025.html > Since I have to support Debian 7 and > probably have to stick to audit 1.7 headers, is it safe to use the > "old way"? > > -Lev > > -- > Linux-audit mailing list > Linux-audit@redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit -- Linux-audit mailing list Linux-audit@redhat.com https://www.redhat.com/mailman/listinfo/linux-audit
