Re: ausearch and terminal

[Daniel J Walsh <dwalsh redhat com>]

On 07/30/2009 10:38 PM, Vadym Chepkov wrote:
> Hi,
> 
> I observe a very strange behavior of the ausearch utility.
> audit-1.7.7-6.el5_3.3
> 
> # cat /root/bin/autest.sh  
> /sbin/ausearch -m avc| wc -l
> 
> If I run it, I get expected results:
> 
> # /root/bin/autest.sh 
> 1563
> 
> But if I run it from cron, I get this in e-mail:
> 
> <no matches>
> 0
> 
> Why??
> 
> Sincerely yours,
>   Vadym Chepkov
> 
> --
> fedora-selinux-list mailing list
> fedora-selinux-list redhat com
> https://www.redhat.com/mailman/listinfo/fedora-selinux-list
Is cron being denied the ability to read the audit.log?  Look for an AVC.