praudit parse with gnu grep

[sam]

Robert Watson wrote:
>
> On Tue, 21 Aug 2007, sam wrote:
>
>>>>>> # praudit /etc/auditpipe | grep "bla bla bla" & # praudit 
>>>>>> /etc/auditpipe | tee file.log
>>>>>>
>>>>>> this is not work please help me
>>>>>
>>>>> This thread is also on freebsd-hackers, but just to follow up here 
>>>>> as well for the purposes of the archives:
>>>>>
>>>>> - It's /dev/auditpipe not /etc/auditpipe
>>>>> - If you're using grep, try --line-buffered
>>>>>
>>>> --line-buffered is not helped to me
>>>
>>> When you run praudit on /dev/auditpipe directly, do you get the 
>>> records you expect?
>>
>> yes
>
> So what are you getting or not getting that is unexpected when you run 
> with grep?  Have you tried forcing lots of records of the type you 
> would be matching to be created to make sure the buffers are flushing 
> from praudit/grep/etc?  The input/output buffers in stdio mean that 
> you may not see output immediately, the buffer has to fill enough to 
> trigger an I/O before that will happen.
>
> We could add an fflush call to praudit's output, which would flush the 
> I/O out the file descriptor, but that wouldn't necessarily solve 
> grep's buffering. The attached patch might do this.
>
> Robert N M Watson
> Computer Laboratory
> University of Cambridge
>
> Index: praudit.c
> ===================================================================
> RCS file: /data/fbsd-cvs/ncvs/src/contrib/openbsm/bin/praudit/praudit.c,v
> retrieving revision 1.1.1.3
> diff -u -r1.1.1.3 praudit.c
> --- praudit.c    16 Apr 2007 15:36:57 -0000    1.1.1.3
> +++ praudit.c    21 Aug 2007 14:26:43 -0000
> @@ -107,6 +107,7 @@
>          free(buf);
>          if (oneline)
>              printf("\n");
> +        fflush(stdout);
>      }
>      return (0);
>  }
>
my big thanks
this patch is working

/Vladimir Ermakov