Re: Audit record emission
On Thursday 05 May 2005 15:52, Linda Knippers wrote:
I've been using ausearch to find things and it seems to do a
nice
job of putting the pieces together.
That kind of counts on records being dumped together.
Maybe we need an option to dump everything, or maybe have an aucat
command?
We are only having one utility to do this.
Or are you finding that under the stress testing, the ausearch
command
doesn't work well because the records are so far apart?
Its more a question of what is the kernel doing? I sent a sample in another
reply.
-Steve