[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: excluding auditd events

Too bad on not using mock; it is in my experience easier than grabbing
pieces needed and certainly easier when those pieces get revised.
The main reason for not using mock (without drifting too much off topic) is because it sets up the chroot environment to mirror the target arch, which is not suitable to me at all - the main reason I use cross-compilation is to utilise the power of the build machine and its architecture - the last think I expected is mock to install GCC and its accompanying tools for the (slow) target arch instead of install/build them for the build arch with the ability for them to cross-compile.

$ sudo ausearch -ts 05/30/2011 | less works fine for me on FC10 & RHEL6.
-bash-4.1# ausearch -ts 05/30/2011 | less
Error parsing start date (05/30/2011)

Look at your system time - is it correct?
Use the "date" command.
Check your LC_TIME ENV variable.
-bash-4.1# date
Wed Jun  1 15:41:53 BST 2011
-bash-4.1# echo $LC_TIME


(I am executing this as root as you can imagine).

-bash-4.1# ausearch -m AVC -ts "05/26/11" | more <- works!

$ sudo ausearch -m AVC -ts "05/26/11"
Error - year is 11
Interesting! I get the desired results and the machine on which this is executed has all the latest (and greatest) packages in it, so I am not using something which could be considered outdated (even though it is all FC13-based a lot of the stuff there is compiled and build from the newest available sources).

This also is the same for me on FC10 & RHEL6 (audit-1.7.16 and
audit-2.1-5 respectively) . So my guess is your LC_TIME or locale value
is set for 2-digit dates or something alone those lines. The "date"
command should yield a clue, especially "date +%x".
-bash-4.1# ausearch --version
ausearch version 2.1.1

-bash-4.1# date +%x

[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]