Better fixing of cursor use

In commit 2e59623a a fix to the cursor use was introduced. However, the fix tries to overcome the issue in a wrong way.

The problem is caused by the fact that the cursor is saved before running the test and then it is used to check newer entries of a specific type (audit). Since when journalctl is used with -t the cursor is first moved to the first entry of the specific type the --after-cursor was changed for --cursor to make the test pass.

However, a better approach would be to save the cursor also taking into account the type of entry we are interested on, so later when we use it we can safetly check entries with --after-crusor.

The only tricky case would be if there are no previous entries of the specific case, which will lead to an empty cursor. So also handle that case.

Signed-off-by: Walter Lozano walter.lozano@collabora.com