audit-3.1.2 has already fixed the 64bit time_t problem on 32bit platform posted in https://listman.redhat.com/archives/linux-audit/2022-October/019553.html , but there was obscure remnant not applied. ==================== --- ./src/ausearch-checkpt.c.t64 2023-08-07 05:38:56.000000000 +0900 +++ ./src/ausearch-checkpt.c 2024-06-12 21:21:47.330473966 +0900 @@ -152,6 +152,7 @@ void save_ChkPt(const char *fn) static int parse_checkpt_event(char *lbuf, int ndix, event *e) { char *rest; + unsigned long long t; /* * Find the space after the node, then make it '\0' so @@ -178,13 +179,14 @@ static int parse_checkpt_event(char *lbu return 1; } } - if (sscanf(rest, TIME_T_SPECIFIER ".%03u:%lu 0x%X", &e->sec, &e->milli, + if (sscanf(rest, TIME_T_SPECIFIER ".%03llu:%lu 0x%X", &t, &e->milli, &e->serial, &e->type) != 4) { fprintf(stderr, "Malformed output/event checkpoint line " "after node - [%s]\n", lbuf); checkpt_failure |= CP_STATUSBAD; return 1; } + e->sec = t; return 0; }