* Pull timestamp from audit event
@ 2007-03-22 18:41 Kirkwood, David A.
2007-03-22 18:56 ` Steve Grubb
0 siblings, 1 reply; 2+ messages in thread
From: Kirkwood, David A. @ 2007-03-22 18:41 UTC (permalink / raw)
To: linux-audit
[-- Attachment #1.1: Type: text/plain, Size: 238 bytes --]
How can I pull the timestamp from a particular audit event. For example:
I want to pull all /bin/su events from the audit log for the week with
when they occurred. How can I do this?
Thanks
David A. Kirkwood
[-- Attachment #1.2: Type: text/html, Size: 2087 bytes --]
[-- Attachment #2: Type: text/plain, Size: 0 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: Pull timestamp from audit event
2007-03-22 18:41 Pull timestamp from audit event Kirkwood, David A.
@ 2007-03-22 18:56 ` Steve Grubb
0 siblings, 0 replies; 2+ messages in thread
From: Steve Grubb @ 2007-03-22 18:56 UTC (permalink / raw)
To: linux-audit; +Cc: Kirkwood, David A.
On Thursday 22 March 2007 14:41, Kirkwood, David A. wrote:
> How can I pull the timestamp from a particular audit event.
Which audit package? For current, there is the auparse library for C and
python.
> For example:
> I want to pull all /bin/su events from the audit log for the week with
> when they occurred. How can I do this?
If you want to do this by shell scripting, you can do this:
aureport --start this-week --end now -i --file | grep \/bin\/su
-Steve
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2007-03-22 18:56 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2007-03-22 18:41 Pull timestamp from audit event Kirkwood, David A.
2007-03-22 18:56 ` Steve Grubb
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.