From 5034c7bcdfc4493ed3c30722e9d897c8da78fede Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Tue, 4 Nov 2014 00:27:55 +0100 Subject: [PATCH 1/1] journald: suppress low-level audit text prefix in MESSAGE= field Let's make the log output more readable, and the header can be reconstructed in full from the other fields --- src/journal/journald-audit.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/journal/journald-audit.c b/src/journal/journald-audit.c index d88d67c5b..520d1cbb3 100644 --- a/src/journal/journald-audit.c +++ b/src/journal/journald-audit.c @@ -354,7 +354,7 @@ static void process_audit_string(Server *s, int type, const char *data, size_t s if (!p) return; - if (sscanf(p, "(%" PRIi64 ".%" PRIi64 ":%" PRIi64 "): %n", + if (sscanf(p, "(%" PRIi64 ".%" PRIi64 ":%" PRIi64 "):%n", &seconds, &msec, &id, @@ -362,6 +362,10 @@ static void process_audit_string(Server *s, int type, const char *data, size_t s return; p += k; + p += strspn(p, WHITESPACE); + + if (isempty(p)) + return; n_iov_allocated = N_IOVEC_META_FIELDS + 5; iov = new(struct iovec, n_iov_allocated); @@ -382,7 +386,7 @@ static void process_audit_string(Server *s, int type, const char *data, size_t s sprintf(id_field, "_AUDIT_ID=%" PRIu64, id); IOVEC_SET_STRING(iov[n_iov++], id_field); - m = strappenda("MESSAGE=", data); + m = strappenda("MESSAGE=audit: ", p); IOVEC_SET_STRING(iov[n_iov++], m); z = n_iov; -- 2.30.2