From: Lennart Poettering <lennart@poettering.net>
Date: Mon, 3 Nov 2014 23:27:55 +0000 (+0100)
Subject: journald: suppress low-level audit text prefix in MESSAGE= field
X-Git-Tag: v218~582
X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=elogind.git;a=commitdiff_plain;h=5034c7bcdfc4493ed3c30722e9d897c8da78fede

journald: suppress low-level audit text prefix in MESSAGE= field

Let's make the log output more readable, and the header can be
reconstructed in full from the other fields
---

diff --git a/src/journal/journald-audit.c b/src/journal/journald-audit.c
index d88d67c5b..520d1cbb3 100644
--- a/src/journal/journald-audit.c
+++ b/src/journal/journald-audit.c
@@ -354,7 +354,7 @@ static void process_audit_string(Server *s, int type, const char *data, size_t s
         if (!p)
                 return;
 
-        if (sscanf(p, "(%" PRIi64 ".%" PRIi64 ":%" PRIi64 "): %n",
+        if (sscanf(p, "(%" PRIi64 ".%" PRIi64 ":%" PRIi64 "):%n",
                    &seconds,
                    &msec,
                    &id,
@@ -362,6 +362,10 @@ static void process_audit_string(Server *s, int type, const char *data, size_t s
                 return;
 
         p += k;
+        p += strspn(p, WHITESPACE);
+
+        if (isempty(p))
+                return;
 
         n_iov_allocated = N_IOVEC_META_FIELDS + 5;
         iov = new(struct iovec, n_iov_allocated);
@@ -382,7 +386,7 @@ static void process_audit_string(Server *s, int type, const char *data, size_t s
         sprintf(id_field, "_AUDIT_ID=%" PRIu64, id);
         IOVEC_SET_STRING(iov[n_iov++], id_field);
 
-        m = strappenda("MESSAGE=", data);
+        m = strappenda("MESSAGE=audit: ", p);
         IOVEC_SET_STRING(iov[n_iov++], m);
 
         z = n_iov;