in reassembler.go [257:284]
func (l *eventList) Put(msg *auparse.AuditMessage) {
l.Lock()
defer l.Unlock()
seq := sequenceNum(msg.Sequence)
e, found := l.events[seq]
// Mark as complete, but do not append.
if msg.RecordType == auparse.AUDIT_EOE {
if found {
e.complete = true
}
return
}
if !found {
l.seqs = append(l.seqs, seq)
l.seqs.Sort()
e = &event{
expireTime: time.Now().Add(l.timeout),
msgs: make([]*auparse.AuditMessage, 0, 4),
}
l.events[seq] = e
}
e.Add(msg)
}