fix a bug that output of "aureport -au" is imperfection

Hello Steve,

Execute command "aureport -au", the output is imperfection.

For example:
[root@RHEL5 ~]# aureport -au

Authentication Report
============================================

# date time acct host term exe success event
============================================
1. 07/22/2008 09:24:39 acct="aulltest rhel5.2ga ssh /usr/sbin/sshd yes 5208350

The reports have a column label at the top to help with interpretation of the various fields, So 'acct="aulltest' should be modified to 'aulltest' in the line 1.

---
 src/ausearch-parse.c |    7 ++++---
 1 files changed, 4 insertions(+), 3 deletions(-)

index 5fdf8c7..141fdee 100644
@@ -786,7 +786,8 @@ static int parse_user(const lnode *n, search_items *s)
 					term++;
 				saved = *term;
 				*term = 0;
-				s->acct = strdup(str);
+				ptr++;
+				s->acct = strdup(ptr);
 				*term = saved;
 			} else { 
 				/* Handle legacy accts */

@@ -802,11 +803,11 @@ static int parse_user(const lnode *n, search_items *s)
 				}
 				term = end;
 				if (!legacy)
-					s->acct = unescape(str);
+					s->acct = unescape(ptr);
 				else {
 					saved = *term;
 					*term = 0;
-					s->acct = strdup(str);
+					s->acct = strdup(ptr);
 					*term = saved;
 				}
 			}

Regards
Peng Haitao

Thanks for the patch.

-Steve