Implement reporting conversion errors in-band
spbnick opened this issue · 0 comments
spbnick commented
Various errors can occur during conversion, such as unknown records/fields, invalid field/record format, unexpected duplicated record types, etc.
Since aushape is supposed to run reliably under auditd, and can't simply stop processing the log, it needs to handle and report those errors somewhere.
Output events which failed to parse as a special type of event, containing the raw records and description of the failure.