Re: buffer space

On Mon, 2009-08-17 at 12:15 -0500, LC Bruzenak wrote: David, I should have been more diligent. The input switch was supposed to be "-if" IIUC. The "-f" switch is looking for a filename inside the record. [root@slim logs-test]# ausearch -i -if `pwd` -m USER <no matches> [root@slim logs-test]# ausearch -i -if `pwd`/audit.log.1 -m USER ... ---- node=slim type=USER msg=audit(08/17/2009 12:10:52.265:305135) : user pid=8191 uid=root auid=lcb ses=4172 subj=user_u:user_r:user_t:s0 msg='TEST message: exe=/sbin/auditctl (hostname=?, addr=?, terminal=pts/18 res=success)' ... This is what you want to do right - search inside a directory other than /var/log/audit with multiple audit logs inside the directory? LCB. Yes but not search for anything specific. Actually all I want to do is convert the logs from kernel text to regular notation (ausearch -i) to start with. I like Steve's idea of doing "service auditd rotate", then moving all the rotated logs to another directory to run the "ausearch -i" on the logs. This way auditd can keep running and processing the logs does not effect auditd. So what you did is pretty much what I want to do with the -if instead of just the -f. Thanks Lenny! David Flatley CISSP