Commits on Source (2)
-
Walter Lozano authoredUsing --after-cursor in combination with -t audit does produces the expected output since the filtering logic is applied before and after that the cursor is moved to next valid entry. In this case, using --after-cursor will cause the output to miss the first entry in the log. Fix the issue by using --cursor instead. Signed-off-by:
Walter Lozano <walter.lozano@collabora.com>2e59623a -
Walter Lozano authored
In commit 2e59623a a fix to the cursor use was introduced. However, the fix tries to overcome the issue in a wrong way. The problem is caused by the fact that the cursor is saved before running the test and then it is used to check newer entries of a specific type (audit). Since when journalctl is used with -t the cursor is first moved to the first entry of the specific type the --after-cursor was changed for --cursor to make the test pass. However, a better approach would be to save the cursor also taking into account the type of entry we are interested on, so later when we use it we can safetly check entries with --after-crusor. The only tricky case would be if there are no previous entries of the specific case, which will lead to an empty cursor. So also handle that case. Signed-off-by:
Walter Lozano <walter.lozano@collabora.com>b1b1ded8