buffer space

Steve Grubb sgrubb at redhat.com
Mon Aug 17 19:37:37 UTC 2009


On Monday 17 August 2009 02:46:30 pm Norman Mark St. Laurent wrote:
> Depending if you are using logrotate.d/audit  and how it numbers the
> files as it rotates...
>
> audit.log.1.gz
> audit.log.2.gz
> ...
> audit.log.89.gz
> audit.log.90.gz
>
> The sort below will but the list in exact order....
>
> zcat `ls /var/log/audit/*.gz | sort -t. --key=3,2n` | ausearch -i

For this to work right, it has to be in descending order. So, add a -r to the 
sort command.

-Steve




More information about the Linux-audit mailing list