Can one compile the lastest ausearch (from 2.4) and just deploy that resultant binary on a RHEL 5 or 6 system

[Steve Grubb]

On Wednesday, September 03, 2014 08:36:23 PM Burn Alting wrote:
> I would like to be able to use some of the recent enhancements to
> ausearch on old RHEL/Centos releases (5.X, 6.X) if that's possible.
> 
> Can I safely achieve this?

On RHEL6, yes. RHEL5...no. There is an ABI difference between RHEL5 and 6 in 
libaudit. There are functions that RHEL5 uses that are deprecated on RHEL6. 
This is the reason that there is a 1.8 branch in svn.


> I realise I would have to hand craft the compilation of ausearch, say within
> the 2.4 release, but am I going to come across other issues?

Unfortunately, yes you will have significant issues on RHEL5. That said, RHEL6 
should be easy. Just use a RHEL6 audit.spec file as your starting point.

-Steve