checkpoint question

[Lenny Bruzenak]

I'm trying to use the ausearch checkpoint feature in conjunction with
the "--just-one" option in order to parse some events one at a time.

However, using this I only get the first event (audit 2.8.5).

IOW I'm doing:

# let CNT=10

# while [ $CNT -gt 0 ] ; do

> auditctl -m "Event $CNT"

> let CNT=$CNT-1

> done

# ausearch -i -ts recent --checkpoint /tmp/check --just-one -m user

< Returns event 10 >

but

# ausearch -i --checkpoint /tmp/check --just-one -m user

<no matches>


Thx,

LCB

-- 
Lenny Bruzenak
MagitekLTD