Some audit records generated by libvirt contain fields enclosed by single quotes. Since those fields are inside the msg field, which is enclosed by single quotes, these records generated by libvirt are not correctly parsed by libauparse. --- src/conf/domain_audit.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/conf/domain_audit.c b/src/conf/domain_audit.c index 7d766a2..934e546 100644 --- a/src/conf/domain_audit.c +++ b/src/conf/domain_audit.c @@ -175,7 +175,7 @@ virDomainAuditNet(virDomainObjPtr vm, } VIR_AUDIT(VIR_AUDIT_RECORD_RESOURCE, success, - "virt=%s resrc=net reason=%s %s uuid=%s old-net='%s' new-net='%s'", + "virt=%s resrc=net reason=%s %s uuid=%s old-net=%s new-net=%s", virt, reason, vmname, uuidstr, oldDef ? oldMacstr : "?", newDef ? newMacstr : "?"); @@ -222,7 +222,7 @@ virDomainAuditNetDevice(virDomainDefPtr vmDef, virDomainNetDefPtr netDef, } VIR_AUDIT(VIR_AUDIT_RECORD_RESOURCE, success, - "virt=%s resrc=net reason=open %s uuid=%s net='%s' %s rdev=%s", + "virt=%s resrc=net reason=open %s uuid=%s net=%s %s rdev=%s", virt, vmname, uuidstr, macstr, dev_name, VIR_AUDIT_STR(rdev)); cleanup: