From 6f032c7cd5f0f8c633a35181569ea0702a69fc42 Mon Sep 17 00:00:00 2001
From: imreACTmd <imre@act.md>
Date: Mon, 9 Jul 2018 15:15:19 -0400
Subject: [PATCH] allow empty syscall filter entry

---
 audit.go      | 4 ----
 audit_test.go | 9 ---------
 2 files changed, 13 deletions(-)

diff --git a/audit.go b/audit.go
index 9cc6cb0..649cb4d 100644
--- a/audit.go
+++ b/audit.go
@@ -296,10 +296,6 @@ func createFilters(config *viper.Viper) ([]AuditFilter, error) {
 			return filters, fmt.Errorf("Filter %d is missing the `regex` entry", i+1)
 		}
 
-		if af.syscall == "" {
-			return filters, fmt.Errorf("Filter %d is missing the `syscall` entry", i+1)
-		}
-
 		if af.messageType == 0 {
 			return filters, fmt.Errorf("Filter %d is missing the `message_type` entry", i+1)
 		}
diff --git a/audit_test.go b/audit_test.go
index d7b96b9..c6000e5 100644
--- a/audit_test.go
+++ b/audit_test.go
@@ -417,15 +417,6 @@ func Test_createFilters(t *testing.T) {
 	assert.EqualError(t, err, "Filter 1 is missing the `message_type` entry")
 	assert.Empty(t, f)
 
-	// Missing message_type
-	c = viper.New()
-	rf = make([]interface{}, 0)
-	rf = append(rf, map[interface{}]interface{}{"message_type": "1", "regex": "1"})
-	c.Set("filters", rf)
-	f, err = createFilters(c)
-	assert.EqualError(t, err, "Filter 1 is missing the `syscall` entry")
-	assert.Empty(t, f)
-
 	// Good with strings
 	c = viper.New()
 	rf = make([]interface{}, 0)