2017-07-27 04:59 AM
Hi,
I was recently looking through v20_rhlinuxmsg.xml on our decoder and discovered something interesting. In the most recent version from Live there is a following message definition:
<MESSAGE
id1="003414"
[...]
content="<agent>: pam_vas: Authentication <<<result>> for <<<event_type>> user: <<<username>> account: <<<c_username>>
; service: <<<service>> reason: <fld1> Access Control Identifier(NT Name):<<<user_address>>" />
Please take note of the 'content' attribute value which contains the following string (after removing XML entity encoding):
<agent>: pam_vas: Authentication <<<result>> for <<<event_type>> user: <<<username>> account: <<<c_username>> service: <<<service>> reason: <fld1> Access Control Identifier(NT Name):<<<user_address>>
What's up with the triple '<' characters? This doesn't look like proper parser message syntax to me at all. Does anyone know what is it? Is it some different type of field? A bug in the XML?
The parser loads and works OK with these "broken" field definitions.
--
mg