[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: Archiving audits daily



On Saturday 18 October 2008 10:58:19 Ed Christiansen wrote:
> I have a requirement to archive audits daily.  I can use the
> audit tools to get all the records for a single day:
>
> ausearch -ts 10/16/2008 00:00:00 -te 10/16/2008 23:59:60
>
> but this returns a processed log entry.

Add "--raw" to the ausearch line and you will get unprocessed lines.

-Steve


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]