Re: [PATCH] ausearch: Add checkpoint capability and have incomplete logs carry forward when processing multiple audit.log files
On Monday, May 13, 2013 05:53:31 PM Steve Grubb wrote:
Below is my diff between what you sent and svn at commit 831.
On Tuesday, May 14, 2013 06:51:17 AM Burn Alting wrote:
> > > - allows ausearch to checkpoint itself, in that, successive
> > > invocations
> > > will only display new events. This is enabled via the --checkpoint fn
> > > option. The mods to ausearch.8 describe the method of achieving this.
This patch has been applied as commit 943 and will be included in the 2.3.6
audit package release. Thanks!
-Steve