ausearch discrepancies?
LC Bruzenak
lenny at magitekltd.com
Fri Jun 5 15:42:18 UTC 2009
On Fri, 2009-06-05 at 11:32 -0400, Steve Grubb wrote:
> On Thursday 04 June 2009 08:37:17 pm LC Bruzenak wrote:
> > This shows plenty of events after the 19:11 event shown.
> > Any ideas?
>
> Looks like a problem. FYI, using aureport shows the exact time range selected
> for the search. (Aureport and ausearch share the same time code.)
>
> -Steve
Seems like it is operating true to the man page (earlier email).
No?
I do not agree with the behavior...but agree it is consistent.
Here is my aureport data:
[root at audit audit]# date ; aureport -ts yesterday -te yesterday -i
Fri Jun 5 10:38:02 CDT 2009
Summary Report
======================
Range of time in logs: 06/04/2009 00:01:01.595 - 12/31/1969 18:00:00.000
Selected time for report: 06/04/2009 00:00:00 - 06/04/2009 10:38:02
...
But that also has possible issues (something might be wrong with the
range):
[root at audit audit]# ausearch -i -ts 12/31/1969 18:00:00.000 --just-one
Error - year is 1969
[root at audit audit]# ausearch -i | head
----
node=jcdx146 type=PATH msg=audit(06/02/2009 22:21:04.582:3374)
LCB.
--
LC (Lenny) Bruzenak
lenny at magitekltd.com
More information about the Linux-audit
mailing list