Re: buffer space

> UGH this is a wrench in the works... > I was hoping to grab all the rotated logs, process them while still > allowing audit > to run with no interruptions. Problem I run into is I run ausearch -i > > > /tmp/file and then > > do ausearch -i /nfs/file with auditd stopped, then compare files and > if they are the same in > size then delete the /tmp/file. I do this to make sure I get the log > in the nfs archive directory > and the /tmp is a backup if there is a problem. If audit is running > there is no way the files will > be equal in size while processing the /var/log/audit data in two > different intervals. It's a problem for me too. I was thinking about just patching the ausearch code to behave as desired...but hoping Steve beat me to it so there was a greatly reduced chance of bad code...