I am creating a parser/converter from the Linux Audit format. As I was studying the format, looking at examples and reading the documentation I stumbled upon a problem.
Can I be sure that the field names inside a single record are unique?
For example, is a record like this one is legal / appear in real world implementations:
type=TYPE msg=audit(1.002:3): msg="the first msg field" msg="the second msg field"
The second related question is whether I can there are there will be only one
pid in an event? For example, is this event is legal / appear in real world implementations:
type=TYPE1 msg=audit(1.002:3): pid=0 msg="texthere" type=TYPE2 msg=audit(1.002:3): pid=0 msg="differenttexthere"