search

linux-audit / audit-userspace

Linux audit userspace repository
GNU General Public License v2.0
567 stars 201 forks source link

Issue343: Fix checkpoint issue to ensure all complete events are gained #345

Closed burnalting closed 5 months ago

burnalting commented 6 months ago

Ausearch only marks events complete (see --checkpoint of ausearch command) when adding a new event from the log source. This means that if the last event in a log source is complete, then it will not be emitted when checkpointing.

This PR addresses this issue.