Re: Can one compile the lastest ausearch (from 2.4) and just deploy that resultant binary on a RHEL 5 or 6 system

On Wednesday, September 03, 2014 08:36:23 PM Burn Alting wrote: > I would like to be able to use some of the recent enhancements to > ausearch on old RHEL/Centos releases (5.X, 6.X) if that's possible. > > Can I safely achieve this? On RHEL6, yes. RHEL5...no. There is an ABI difference between RHEL5 and 6 in libaudit. There are functions that RHEL5 uses that are deprecated on RHEL6. This is the reason that there is a 1.8 branch in svn. > I realise I would have to hand craft the compilation of ausearch, say within > the 2.4 release, but am I going to come across other issues? Unfortunately, yes you will have significant issues on RHEL5. That said, RHEL6 should be easy. Just use a RHEL6 audit.spec file as your starting point. -Steve