ausearch discrepancies?

Steve Grubb sgrubb at redhat.com
Fri Jun 5 15:32:35 UTC 2009


On Thursday 04 June 2009 08:37:17 pm LC Bruzenak wrote:
> This shows plenty of events after the 19:11 event shown.
> Any ideas?

Looks like a problem. FYI, using aureport shows the exact time range selected 
for the search. (Aureport and ausearch share the same time code.)

-Steve




More information about the Linux-audit mailing list