2007-08-02  Aron Griffis  <aron@hp.com>

	* .hgtags:
	Added tag 2.2 for changeset 9679351d89af
	[881048eaef31] [tip]

	* augrok:
	Fix tagged query bugs

	Instead of starting with a full @ft and eliminating possibilities in
	dotest_pre, start with an empty @ft and build up the list in
	dotest_pre. This avoids a few bugs such as all possibilities being
	eliminated for an "or" expression such as type#a==SYSCALL or
	type#a==CWD
	[9679351d89af] [2.2]

2007-08-01  Aron Griffis  <aron@hp.com>

	* .hgtags:
	Added tag 2.1 for changeset 52621bd89390
	[58786a94c470]

	* augrok:
	Bump version to 2.1 for tagged query optimizations
	[52621bd89390] [2.1]

	* augrok:
	Use dotest_pre to help generate tagline combinations
	[99f60f725859]

	* augrok:
	Prep for more optimization; wrap do { } generically
	[8df89bfe96ea]

	* augrok:
	Use $qv in numeric comparisons for consistency with string
	comparisons
	[8ce934d0c6fe]

	* augrok:
	For tagged queries, generate two test functions: dotest and
	dotest_pre

	Split processing of tagged queries into two functions: dotest and
	dotest_pre. The latter runs all the conditions as if they were
	untagged, so they can match any line. This allows augrok to avoid
	looping over tags if there's no chance of matching.

	A possible second step would be to use dotest_pre to generate the
	@ft for the current record. That would kill the taglines_cache (a
	good thing, maybe?) but would avoid most of the useless looping.
	[4dee09bbe4df]

	* augrok:
	Convert leading tabs from 3:e6d571340a07 to spaces
	[206c508ae011]

	* augrok:
	Change license from "GPL-2 or later" to "GPL-2"
	[dec531dfcce6]

2007-07-10  Aron Griffis  <aron@hp.com>

	* augrok:
	Prepend "augrok version" to $version
	[f51a655f587d]

2007-07-09  Aron Griffis  <aron@hp.com>

	* Makefile:
	Add space after Version: in generated audit.spec
	[3d8cbf8b8b77]

	* augrok:
	Remove subversion $Revision$ keyword
	[b95c793c69fb]

	* .hgtags:
	Added tag 2.0 for changeset 9433810ec37f
	[ab1d73980de6]

	* augrok:
	Major updates for RHEL5 CAPP/LSPP certification
	[9433810ec37f] [2.0]

	* .hgtags:
	Added tag 1.1 for changeset d8a1907b5aeb
	[b1243d305493]

	* augrok:
	Update $version to 1.1
	[d8a1907b5aeb] [1.1]

	* augrok:
	Additional success/failure definitions from ausearch-1.3 (Amy
	Griffis)
	[e6d571340a07]

	* augrok:
	Try to emulate ausearch for the -sv=yes/no search (Bill O'Donnell)

	ausearch works differently in 1.0.12 (not sure when the change was
	introduced), it searches msg='...' fields to determine if operations
	are successful or not, instead of only looking at the success=...
	field.

	Try to replicate the ausearch behavior for the -sv=yes/no search.
	The preferred solution would be to fix the audit record format, but
	that patch would be rather larger.

	Fix provided by: Bill O'Donnell <billodo@sgi.com>
	[3a8ddc2315ef]

	* .hgtags:
	Added tag 1.0 for changeset cd3ef2c5c85d
	[2a5b172a993b]

	* .hgignore, COPYING, Makefile, augrok, augrok.spec.in, hg-changelog:
	New repository for augrok, extracted from audit-test.sf.net
	[cd3ef2c5c85d] [1.0]

