buffer space
Norman Mark St. Laurent
mstlaurent at conceras.com
Mon Aug 17 18:13:45 UTC 2009
cat --> zcat for the gzip files... THANKS Steve... Very Nice....
Norman Mark St. Laurent
Conceras | Chief Technology Officer and ISSE
Phone: 703-965-4892
Email: mstlaurent at conceras.com
Web: http://www.conceras.com
Connect. Collaborate. Conceras.
Steve Grubb wrote:
> On Monday 17 August 2009 01:46:03 pm LC Bruzenak wrote:
>
>>> UGH this is a wrench in the works...
>>> I was hoping to grab all the rotated logs, process them while still
>>> allowing audit
>>> to run with no interruptions. Problem I run into is I run ausearch -i
>>>
>>>
>>>> /tmp/file and then
>>>>
>>> do ausearch -i /nfs/file with auditd stopped, then compare files and
>>> if they are the same in
>>> size then delete the /tmp/file. I do this to make sure I get the log
>>> in the nfs archive directory
>>> and the /tmp is a backup if there is a problem. If audit is running
>>> there is no way the files will
>>> be equal in size while processing the /var/log/audit data in two
>>> different intervals.
>>>
>> It's a problem for me too.
>> I was thinking about just patching the ausearch code to behave as
>> desired...but hoping Steve beat me to it so there was a greatly reduced
>> chance of bad code...
>>
>
> #cat `ls /var/log/audit/a* | sort -r` | ausearch -i
> #cat `ls /var/log/audit/a* | sort -r` | aureport
>
> cat can open more than one file at a time,
>
> -Steve
>
> --
> Linux-audit mailing list
> Linux-audit at redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit
>
>
>
More information about the Linux-audit
mailing list