openbsm icon indicating copy to clipboard operation
openbsm copied to clipboard

Consolidate space delimiter in TID XML field

Open natpicone opened this issue 3 years ago • 3 comments

XML output has issues in the TID field; it does not always have the space delimiter between the port number and the IP address data. This causes the filed content to be malformed and unparsable. Only in one case space is used as a delimiter. This change just adds the space character everywhere.

Example output received using praudit -lx ......

<record version="11" event="sudo(1)" modifier="0" time="Thu Oct 14 08:51:14 2021" msec=" + 275 msec" ><subject audit-uid="1004" uid="root" gid="wheel" ruid="1004" rgid="1004" pid="14991" sid="14991" tid="5533410.68.67.99" /><exec_args><arg>su</arg></exec_args><return errval="success" retval="0" /></record>
<record version="11" event="su(1)" modifier="0" time="Thu Oct 14 08:51:14 2021" msec=" + 277 msec" ><subject audit-uid="1004" uid="root" gid="wheel" ruid="root" rgid="wheel" pid="17229" sid="17229" tid="55334 10.68.67.99" /><text>successful authentication</text><return errval="success" retval="0" /></record>

natpicone avatar Nov 24 '21 16:11 natpicone

@cbrueffer Do you mind taking a look at this?

natpicone avatar Dec 16 '21 15:12 natpicone

This looks reasonable, let take a closer look

csjayp avatar Dec 18 '21 00:12 csjayp

This looks reasonable, let take a closer look

@csjayp Can you please merge this fix?

natpicone avatar Jun 16 '23 14:06 natpicone