When audit.log is opened with cat or less, for example, with log format = ENRICHED, there's no space between data and the enriched part, only AUDIT_INTERP_SEPARATOR (0x1d):
type=USER_CMD msg=audit(1631669179.082:2403): ... res=success'UID="enzo" AUID="unset" ^ (0x1d) sep_done should be checked if it's 1 as well, so a space is added before the first enriched field. Signed-off-by: Enzo Matsumiya <ematsum...@suse.de> --- src/auditd-event.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/auditd-event.c b/src/auditd-event.c index 788c44a08197..636553187279 100644 --- a/src/auditd-event.c +++ b/src/auditd-event.c @@ -365,7 +365,7 @@ static int add_simple_field(auparse_state_t *au, size_t len_left, int encode) // Setup pointer ptr = &format_buf[FORMAT_BUF_LEN - len_left]; - if (sep_done > 1) { + if (sep_done >= 1) { *ptr = ' '; ptr++; num = 1; -- 2.33.0 -- Linux-audit mailing list Linux-audit@redhat.com https://listman.redhat.com/mailman/listinfo/linux-audit