diff -Npru audit-2.3.7/docs/ausearch.8 audit-2.3.7_checkpoint_errata/docs/ausearch.8
--- audit-2.3.7/docs/ausearch.8	2014-06-04 02:06:03.000000000 +1000
+++ audit-2.3.7_checkpoint_errata/docs/ausearch.8	2014-08-20 17:59:45.138353268 +1000
@@ -134,13 +134,29 @@ is assumed. Use 24 hour clock time rathe
 You may also use the word: \fBnow\fP, \fBrecent\fP, \fBtoday\fP, \fByesterday\fP, \fBthis\-week\fP, \fBweek\-ago\fP, \fBthis\-month\fP, \fBthis\-year\fP. \fBToday\fP means starting now. \fBRecent\fP is 10 minutes ago. \fBYesterday\fP is 1 second after midnight the previous day. \fBThis\-week\fP means starting 1 second after midnight on day 0 of the week determined by your locale (see \fBlocaltime\fP). \fBThis\-month\fP means 1 second after midnight on day 1 of the month. \fBThis\-year\fP means the 1 second after midnight on the first day of the first month.
 .TP
 .BR \-ts ,\  \-\-start \ [\fIstart-date\fP]\ [\fIstart-time\fP]
-Search for events with time stamps equal to or after the given end time. The format of end time depends on your locale. If the date is omitted, 
+Search for events with time stamps equal to or after the given start time. The format of start time depends on your locale. If the date is omitted, 
 .B today
 is assumed. If the time is omitted, 
 .B midnight
 is assumed. Use 24 hour clock time rather than AM or PM to specify time. An example date using the en_US.utf8 locale is 09/03/2009. An example of time is 18:00:00. The date format accepted is influenced by the LC_TIME environmental variable.
 
-You may also use the word: \fBnow\fP, \fBrecent\fP, \fBtoday\fP, \fByesterday\fP, \fBthis\-week\fP, \fBthis\-month\fP, \fBthis\-year\fP. \fBToday\fP means starting at 1 second after midnight. \fBRecent\fP is 10 minutes ago. \fBYesterday\fP is 1 second after midnight the previous day. \fBThis\-week\fP means starting 1 second after midnight on day 0 of the week determined by your locale (see \fBlocaltime\fP). \fBThis\-month\fP means 1 second after midnight on day 1 of the month. \fBThis\-year\fP means the 1 second after midnight on the first day of the first month.
+You may also use the word: \fBnow\fP, \fBrecent\fP, \fBtoday\fP, \fByesterday\fP, \fBthis\-week\fP, \fBthis\-month\fP, \fBthis\-year\fP, or \fBcheckpoint\fP. \fBToday\fP means starting at 1 second after midnight. \fBRecent\fP is 10 minutes ago. \fBYesterday\fP is 1 second after midnight the previous day. \fBThis\-week\fP means starting 1 second after midnight on day 0 of the week determined by your locale (see \fBlocaltime\fP). \fBThis\-month\fP means 1 second after midnight on day 1 of the month. \fBThis\-year\fP means the 1 second after midnight on the first day of the first month.
+.sp
+\fBcheckpoint\fP means \fIausearch\fP is to use the timestamp found within a valid checkpoint file as the start time to generate records from, ignoring the recorded inode, device, serial, node and event type also found within a checkpoint file. Essentailly, this is the recovery action should an invocation of \fIausearch\fP with a checkpoint option fail with an exit status of 10, 11 or 12. An appropriate script extract might look like
+.sp
+.in +5
+.nf
+.na
+ausearch --checkpoint /etc/audit/auditd_checkpoint.txt -i
+_au_status=$?
+if test ${_au_status} eq 10 -o ${_au_status} eq 11 -o ${_au_status} eq 12
+then
+  ausearch --checkpoint /etc/audit/auditd_checkpoint.txt --start checkpoint -i
+fi
+.ad
+.fi
+.in -5
+
 .TP
 .BR \-tm ,\  \-\-terminal \ \fIterminal\fP
 Search for an event matching the given \fIterminal\fP value. Some daemons such as cron and atd use the daemon name for the terminal.
diff -Npru audit-2.3.7/src/ausearch.c audit-2.3.7_checkpoint_errata/src/ausearch.c
--- audit-2.3.7/src/ausearch.c	2014-06-04 02:06:00.000000000 +1000
+++ audit-2.3.7_checkpoint_errata/src/ausearch.c	2014-08-20 17:21:17.594034276 +1000
@@ -58,6 +58,7 @@ static int process_file(char *filename);
 static int get_record(llist **);
 
 extern const char *checkpt_filename;	/* checkpoint file name */
+extern int checkpt_timeonly;		/* if non-zero, only use timestamp from within checkpoint file */
 static int have_chkpt_data = 0;		/* have checkpt need to compare wit */
 extern char *user_file;
 extern int force_logs;
@@ -244,8 +245,15 @@ static int process_logs(void)
 			 */
 			if (	(sbuf.st_dev == chkpt_input_dev) &&
 				(sbuf.st_ino == chkpt_input_ino) ) {
-				found_chkpt_file = num++;
-				break;
+				/*
+				 * If we are ignoing all but time, then we don't stop checking more
+				 * files and just let this loop go to completion and hence
+				 * we will find the 'oldest' file.
+				 */
+				if (!checkpt_timeonly) {
+					found_chkpt_file = num++;
+					break;
+				}
 			}
 		}
 
@@ -253,8 +261,11 @@ static int process_logs(void)
 		snprintf(filename, len, "%s.%d", config.log_file, num);
 	} while (1);
 
-	/* If a checkpoint is loaded but can't find it's file, error */
-	if (checkpt_filename && have_chkpt_data && found_chkpt_file == -1) {
+	/* If a checkpoint is loaded but can't find it's file, and
+ 	 * we are not only just checking the timestamp from the checkpoint file,
+ 	 * we need to error */
+	if (checkpt_filename && have_chkpt_data && found_chkpt_file == -1
+	&& !checkpt_timeonly) {
 		free(filename);
 		free_config(&config);
 		return 10;
@@ -342,6 +353,26 @@ static int chkpt_output_decision(event *
 		return 1;	/* can output on this event */
 	}
 
+	/*
+	 * If we are ignoring all but event time from within the checkpoint
+	 * file, then we output if the current event's time is greater than
+	 * or equal to the checkpoint time.
+	 */
+	if (checkpt_timeonly) {
+		if (
+			(chkpt_input_levent.sec < e->sec)
+		||
+			(
+				(chkpt_input_levent.sec == e->sec)
+			&&
+				(chkpt_input_levent.milli <= e->milli)
+			)
+		) {
+			can_output = 1;
+			return 1;   /* can output on this event */
+		}
+	}
+
 	if ( chkpt_input_levent.sec == e->sec &&
 		chkpt_input_levent.milli == e->milli &&
 		chkpt_input_levent.serial == e->serial &&
diff -Npru audit-2.3.7/src/ausearch-options.c audit-2.3.7_checkpoint_errata/src/ausearch-options.c
--- audit-2.3.7/src/ausearch-options.c	2014-06-04 02:06:00.000000000 +1000
+++ audit-2.3.7_checkpoint_errata/src/ausearch-options.c	2014-08-20 17:22:30.777824134 +1000
@@ -56,6 +56,7 @@ int event_session_id = -2;
 int event_exit = 0, event_exit_is_set = 0;
 int line_buffered = 0;
 int event_debug = 0;
+int checkpt_timeonly = 0;
 const char *event_key = NULL;
 const char *event_filename = NULL;
 const char *event_exe = NULL;
@@ -209,7 +210,7 @@ static void usage(void)
 	"\t-su,--subject <SE Linux context> search based on context of the Subject\n"
 	"\t-sv,--success <Success Value>\tsearch based on syscall or event\n\t\t\t\t\tsuccess value\n"
 	"\t-te,--end [end date] [end time]\tending date & time for search\n"
-	"\t-ts,--start [start date] [start time]\tstarting data & time for search\n"
+	"\t-ts,--start [start date] [start time]|['checkpoint']\tstarting data & time for search\n"
 	"\t-tm,--terminal <TerMinal>\tsearch based on terminal\n"
 	"\t-ua,--uid-all <all User id>\tsearch based on All user id's\n"
 	"\t-ue,--uid-effective <effective User id>  search based on Effective\n\t\t\t\t\tuser id\n"
@@ -873,7 +874,10 @@ int check_params(int count, char *vars[]
 							"00:00:00") != 0)
 							retval = -1;
 					}
-					else if ( strchr(optarg, ':') == NULL) {
+					else if ( strcmp(optarg, "checkpoint") == 0) {
+						/* Only use the timestamp from within the checkpoint file */
+						checkpt_timeonly++;
+					} else if ( strchr(optarg, ':') == NULL) {
 						/* Only have date */
 						if (ausearch_time_start(optarg,
 							"00:00:00") != 0)
