buffer space

[Steve Grubb]

On Monday 17 August 2009 01:46:03 pm LC Bruzenak wrote:
> >   UGH this is a wrench in the works...
> >   I was hoping to grab all the rotated logs, process them while still
> > allowing audit
> > to run with no interruptions. Problem I run into is I run ausearch -i
> >
> > > /tmp/file and then
> >
> > do ausearch -i /nfs/file with auditd stopped, then compare files and
> > if they are the same in
> > size then delete the /tmp/file. I do this to make sure I get the log
> > in the nfs archive directory
> > and the /tmp is a backup if there is a problem. If audit is running
> > there is no way the files will
> > be equal in size while processing the /var/log/audit data in two
> > different intervals.
>
> It's a problem for me too.
> I was thinking about just patching the ausearch code to behave as
> desired...but hoping Steve beat me to it so there was a greatly reduced
> chance of bad code...

#cat `ls /var/log/audit/a* | sort -r` | ausearch -i
#cat `ls /var/log/audit/a* | sort -r` | aureport

cat can open more than one file at a time,

-Steve