Store the source of the matching rule and store in the event log.
The JSON logs will store the matching rule source.
This commit is contained in:
@@ -906,6 +906,9 @@ fmt_info_messages(struct client_closure *closure, struct eventlog *evlog,
|
||||
/* TODO - rungroups */
|
||||
fill_num("runuid", evlog->runuid);
|
||||
fill_str("runuser", evlog->runuser);
|
||||
if (evlog->source != NULL) {
|
||||
fill_str("source", evlog->source);
|
||||
}
|
||||
if (evlog->cwd != NULL) {
|
||||
fill_str("submitcwd", evlog->cwd);
|
||||
}
|
||||
|
Reference in New Issue
Block a user