On Tue, Oct 15, 2024 at 12:20:59AM +0200, Florian Westphal wrote: > Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote: > > At quick glance, I can see the audit logic is based in transaction > > objects, so now it counts one single entry for the two elements in one > > single transaction. I can look into this to fix this. > > > > Florian, are you seing any other issues apart for this miscount? > > Yes, crash when bisecting (its "fixed" by later patch, > hunk must be moved to earlier patch), nft_trans_elems_activate > must emit notify also for update case. Correct, event is missed. > Maybe more. Just remove these patches. OK, this needs more work.