<html dir="ltr"><head></head><body style="text-align:left; direction:ltr;"><div style="margin-left: 3ch;"><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">Yes please, 2 questions : </span></div><div style="margin-left: 3ch;"><br style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">1) Is there a way to run aureport on updating auditd logs ? That is, not </span><br style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">running aureport on all logs, just updating the last aureport with the </span><br style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">recent addition of logs ? </span><br style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">2) Could aureport run on combined auditd logs from more than one computor </span><br style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">and produce multiple outputs ? </span><br style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><br style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">Thank you </span><br style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><div><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><br></span></div></div><div>To answer the above</div><div>For 1. use the -checkpoint option of ausearch to generate the events.</div><div>For 2. assuming you disseminate the source hosts on the aggregating host, again multiple invocations of ausearch will work with the -checkpoint option.</div><div><br></div><div>Rgds</div></body></html>