Q: audit log rotation.

[Steve Grubb]

On Tuesday 18 April 2006 12:54, The UnSeen wrote:
> Is there a way to dictate the format of naming convention of the rotated
> logfiles to better reflect the date range of the data contained in the
> file instead of simply audit.log.1, audit.log.2, etc?

No. But you can easily cobble something together to do it. BTW, "aureport -t" 
will give you the time ranges.

> Also, it would be nice (if it doesn't exist already) to have a way to do
> audit reductions 1 event on a line instead of X lines for an event.

I suspect that will get messy. You can have a lot of information without a 
visual cue to help decipher what you are looking at. Have you played around 
with aureport ? It was intended to give something more concise, 1 event per 
line. It also gives everything you need to track down the event in the audit 
logs if you need more information.

But just in case you want to see it:

ausearch -ts 1:00:00 | grep -v 'time->' | tr '\n' ' ' | sed -e 's/----/\n/g'

to get the events since 1 am, one per line.

-Steve