Re: ausearch discrepancies?
On Fri, 2009-06-05 at 11:32 -0400, Steve Grubb wrote:
On Thursday 04 June 2009 08:37:17 pm LC Bruzenak wrote:
> This shows plenty of events after the 19:11 event shown.
> Any ideas?
Looks like a problem. FYI, using aureport shows the exact time range selected
for the search. (Aureport and ausearch share the same time code.)
-Steve
Seems like it is operating true to the man page (earlier email).
No?
I do not agree with the behavior...but agree it is consistent.
Here is my aureport data:
[root@audit audit]# date ; aureport -ts yesterday -te yesterday -i
Fri Jun 5 10:38:02 CDT 2009
Summary Report
======================
Range of time in logs: 06/04/2009 00:01:01.595 - 12/31/1969 18:00:00.000
Selected time for report: 06/04/2009 00:00:00 - 06/04/2009 10:38:02
...
But that also has possible issues (something might be wrong with the
range):
[root@audit audit]# ausearch -i -ts 12/31/1969 18:00:00.000 --just-one
Error - year is 1969
[root@audit audit]# ausearch -i | head
----
node=jcdx146 type=PATH msg=audit(06/02/2009 22:21:04.582:3374)
LCB.
--
LC (Lenny) Bruzenak
lenny(a)magitekltd.com