diff --git a/auditd-plugin-clickhouse.cpp b/auditd-plugin-clickhouse.cpp index cc08e76..32f63f2 100644 --- a/auditd-plugin-clickhouse.cpp +++ b/auditd-plugin-clickhouse.cpp @@ -937,19 +937,6 @@ int main(int argc, char **argv) } } - std::unique_ptr au(auparse_init(AUSOURCE_FEED, 0), [](auparse_state_t *obj){ - if (obj) - { - auparse_flush_feed(obj); - auparse_destroy(obj); - } - }); - - if (!au) - { - throw std::runtime_error("Failed to initialize audit"); - } - std::unique_ptr writer_thread( use_writer_thread ? new std::thread( writer_thread_function, @@ -976,6 +963,19 @@ int main(int argc, char **argv) } }); + std::unique_ptr au(auparse_init(AUSOURCE_FEED, 0), [](auparse_state_t *obj){ + if (obj) + { + auparse_flush_feed(obj); + auparse_destroy(obj); + } + }); + + if (!au) + { + throw std::runtime_error("Failed to initialize audit"); + } + auparse_add_callback(au.get(), auparse_callback, &callback_data, NULL); std::vector data;