Re: How to read audit log?
On Tuesday 25 September 2007 12:43:52 James Antill wrote:
> Yes. It would let you write an app that is more efficient than
using perl
> on ausearch output.
That's not really true,
Sure it is. perl cannot do the interpretations. So you'd have to spend time
writing all that code and maintain it or use ausearch to provide you that
functionality.
and when it is true it's only because ausearch is so slow at
doing "cat":
It does a lot more than "cat". For example, it understands the ordering
requirements of the logs and searches them in the correct order. It also
assembles the records into an event before presenting them. It interprets
some of the data so that its more usable even if you don't ask for a full
interpretation.
-Steve