Re: buffer space

On Monday 17 August 2009 01:46:03 pm LC Bruzenak wrote: >> UGH this is a wrench in the works... >> I was hoping to grab all the rotated logs, process them while still >> allowing audit >> to run with no interruptions. Problem I run into is I run ausearch -i >> >> >>> /tmp/file and then >>> >> do ausearch -i /nfs/file with auditd stopped, then compare files and >> if they are the same in >> size then delete the /tmp/file. I do this to make sure I get the log >> in the nfs archive directory >> and the /tmp is a backup if there is a problem. If audit is running >> there is no way the files will >> be equal in size while processing the /var/log/audit data in two >> different intervals. >> > It's a problem for me too. > I was thinking about just patching the ausearch code to behave as > desired...but hoping Steve beat me to it so there was a greatly reduced > chance of bad code... > #cat `ls /var/log/audit/a* | sort -r` | ausearch -i #cat `ls /var/log/audit/a* | sort -r` | aureport cat can open more than one file at a time, -Steve -- Linux-audit mailing list Linux-audit(a)redhat.com https://www.redhat.com/mailman/listinfo/linux-audit