Re: aureport question
On Sunday 20 December 2009 04:10:29 pm LC Bruzenak wrote:
The aureport utility has an option to use an alternative input file.
Right. This is to override the directory setting that it gets from
auditd.conf.
Because I have to move my logs, I really need an alternative input
directory, preferably a starting point, since my saved logs are:
/var/log/audit-archive/<YEAR>/<MONTH>/<DAY> .
Then I could do "aureport --topdir /var/log/audit-archive/2009/12 "
and get all the 12/2009 events up to now.
What do you think?
This trick doesn't work any more?
https://www.redhat.com/archives/linux-audit/2009-August/msg00031.html
You could do
cat `ls /var/log/audit-archive/<YEAR>/<MONTH>/<DAY>/a* | sort -r` |
aureport
and it should work.
I thought about creating a different flat directory and just linking
the files I want, however I do not think the current options will
allow this either. I guess that would be the easiest change though, to
allow the -if parameter to be a directory or a file.
I suppose that could be done. But whatever we do in aureport, we need to do to
ausearch since they share a lot of code and design.
-Steve