mcafee/mysql-audit — pull request #36 by halides (2013-03-05 09:21:31+00:00)
Title: Adding datagram-socket functionality

Moved 'int sock' declaration to class definiton in the header, as it is needed in more places than with just a stream socket.
I've added only the offset for the 32bit source code distribution.

I tried a couple of if's to choose whether to print or not the newline (audit_handler.cc, around line 491). I also took a look at using the msg_delimiter but I'm still running on low steam and this is my second to last day at this workplace. Maybe you have a good idea for this?

What I gathered from rsyslog doing a proper parser for the JSON is a bit of a pain. As far as I understood you need to actually write it in weird "rsyslog C" and then compile it into the binary.
Sending the messages from the audit plugin in the current syslog format http://tools.ietf.org/html/rfc5424 or the legacy format http://tools.ietf.org/html/rfc3164 would make things easier. I'll actually see if I can make sense of the event_formatter and make an optional formatter.

I figured a month would be enough to do this properly (as a side project during work) but a bad case of sciatica renders it's toll. Last three weeks my ability to concentrate has been most lacking.