Merge pull request #3 from metal-toolbox/relax-compound-event-message…

…-check

aucoalesce: Be more forgiving of compound events.

aucoalesce/coalesce.go

@@ -218,9 +218,10 @@ func normalizeCompound(msgs []*auparse.AuditMessage) (*Event, error) {
 			break
 		}
 	}
-	if syscall == nil {
-		// All compound records have syscall messages.
-		return nil, errors.New("missing syscall message in compound event")
+	if special == nil && syscall == nil {
+		return nil, &CompoundEventError{
+			message: "compound event's special and syscall audit messages are nil",
+		}
 	}
 
 	event := newEvent(special, syscall)

aucoalesce/errors.go

@@ -0,0 +1,11 @@
+package aucoalesce
+
+// CompoundEventError is returned by CoalesceMessages when a compound
+// audit event cannot be parsed.
+type CompoundEventError struct {
+	message string
+}
+
+func (o *CompoundEventError) Error() string {
+	return o.message
+}