Re: audisp-prelude problems
On Wednesday 03 December 2008 12:17:46 LC Bruzenak wrote:
MY favorite: ask Steve how to make the aggregating side flexible in
this regard.
Why did I know this was coming? :)
We may need a BZ filed or a consensus about what is important on this
list. I
also would like a separation based on time to allow for an easier
archive/restore capability
There is a cron script shipped but not installed that can do the right thing.
...and maybe that built in if possible! Separation based on node is
also a
potential "good thing".
The main poblem is that once its separated, ausearch/report don't know how to
put it back together again. The current algorithm is a simple number index and
ausearch, aureport, and even auparse knows how to find the files in the right
order to make sense of it.
-Steve