On Thursday 13 December 2007 1:50:59 pm Eric Paris wrote: > My real question is not whether this is a good idea but more how are > the certification tests going to react to having new information > appear in the records?
I'm pretty sure it shouldn't affect our audit tests as they typically just involve running a regex over the audit record without regard to the actual field position within the record. Personally I'd say add the new field wherever you see fit - I think relying on field position is bad practice and we shouldn't bend over backwards trying to accommodate those apps which are sensitive to field position. -- paul moore linux security @ hp -- redhat-lspp mailing list [email protected] https://www.redhat.com/mailman/listinfo/redhat-lspp
