Hi,I've seen that you had a few patches merged to 3.7.2, and I'm not sure what to include in the docs about them:- There were some csv-parser changes, is any of them user-visible?
- What does linux-audit-parser do? Does it require any configuration, or it just works?
The some fields in the audit log are encoded in hexadecimal form if they contain space or non-printable characters. linux-audit-parser() will automatically decode these fields,
"name",
"proctitle",
"path",
"dir",
"comm",
"ocomm",
"data",
"old",
"new",
and a hard-coded pattern (a[:digits:]* will be decoded as well), the rest is kept intact.
Thanks!Robert