Re: excluding auditd events
Too bad on not using mock; it is in my experience easier than
grabbing
pieces needed and certainly easier when those pieces get revised.
The main reason for not using mock (without drifting too much off topic)
is because it sets up the chroot environment to mirror the target arch,
which is not suitable to me at all - the main reason I use
cross-compilation is to utilise the power of the build machine and its
architecture - the last think I expected is mock to install GCC and its
accompanying tools for the (slow) target arch instead of install/build
them for the build arch with the ability for them to cross-compile.
$ sudo ausearch -ts 05/30/2011 | less
works fine for me on FC10 & RHEL6.
-bash-4.1# ausearch -ts 05/30/2011 | less
Error parsing start date (05/30/2011)
Look at your system time - is it correct?
Use the "date" command.
Check your LC_TIME ENV variable.
-bash-4.1# date
Wed Jun 1 15:41:53 BST 2011
-bash-4.1# echo $LC_TIME
-bash-4.1#
(I am executing this as root as you can imagine).
> -bash-4.1# ausearch -m AVC -ts "05/26/11" | more <-
works!
>
$ sudo ausearch -m AVC -ts "05/26/11"
Error - year is 11
Interesting! I get the desired results and the machine on which this is
executed has all the latest (and greatest) packages in it, so I am not
using something which could be considered outdated (even though it is
all FC13-based a lot of the stuff there is compiled and build from the
newest available sources).
This also is the same for me on FC10 & RHEL6 (audit-1.7.16 and
audit-2.1-5 respectively) . So my guess is your LC_TIME or locale value
is set for 2-digit dates or something alone those lines. The "date"
command should yield a clue, especially "date +%x".
-bash-4.1# ausearch --version
ausearch version 2.1.1
-bash-4.1# date +%x
01/06/11