Re: audit 2.3.7 released

Steve, Please find a patch against 2.3.7 that, when check pointing, ausearch will only use the recorded event time in the checkpoint file when deciding what complete events to display. Basically, it will display all complete events found after the event time found in the checkpoint file. Normally, one would use check pointing in a periodic script that records all 'new' audit events. Should certain errors occur, we need to recover and continue to record 'new' audit events. This option allows use to do a 'brute force' recovery by finding all events since the last recorded time we have in the checkpoint file. For example, the core of a periodic script may contain ausearch --checkpoint /usr/security/auditd_checkpoint.txt -i _aus=$? if test ${_aus} -eq 10 -o ${_aus} -eq 11 -o ${_aus} -eq 12 then ausearch --checkpoint /usr/security/auditd_checkpoint.txt \ --checkpoint-time-only -i fi Rgds On Wed, 2014-06-04 at 17:47 -0400, Steve Grubb wrote: