[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: buffer space



cat --> zcat  for the gzip files...  THANKS Steve...  Very Nice....

Norman Mark St. Laurent
Conceras | Chief Technology Officer and ISSE
Phone:  703-965-4892
Email:  mstlaurent conceras com
Web:  http://www.conceras.com

Connect. Collaborate. Conceras.



Steve Grubb wrote:
On Monday 17 August 2009 01:46:03 pm LC Bruzenak wrote:
  UGH this is a wrench in the works...
  I was hoping to grab all the rotated logs, process them while still
allowing audit
to run with no interruptions. Problem I run into is I run ausearch -i

/tmp/file and then
do ausearch -i /nfs/file with auditd stopped, then compare files and
if they are the same in
size then delete the /tmp/file. I do this to make sure I get the log
in the nfs archive directory
and the /tmp is a backup if there is a problem. If audit is running
there is no way the files will
be equal in size while processing the /var/log/audit data in two
different intervals.
It's a problem for me too.
I was thinking about just patching the ausearch code to behave as
desired...but hoping Steve beat me to it so there was a greatly reduced
chance of bad code...

#cat `ls /var/log/audit/a* | sort -r` | ausearch -i
#cat `ls /var/log/audit/a* | sort -r` | aureport

cat can open more than one file at a time,

-Steve

--
Linux-audit mailing list
Linux-audit redhat com
https://www.redhat.com/mailman/listinfo/linux-audit




[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]