From mboxrd@z Thu Jan  1 00:00:00 1970
From: James Antill <jantill@redhat.com>
Subject: Re: missing avc message field names
Date: Tue, 30 Jan 2007 17:53:08 -0500
Message-ID: <1170197588.3373.28.camel@laptop.and.org>
References: <20070129185542.32977.qmail@web51502.mail.yahoo.com>
	<200701291556.37235.sgrubb@redhat.com> <45BE6410.9050604@redhat.com>
	<200701291749.21897.sgrubb@redhat.com>
	<45BF5AE3.6030602@mentalrootkit.com>
Mime-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <45BF5AE3.6030602@mentalrootkit.com>
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: Karl MacMillan <kmacmillan@mentalrootkit.com>
Cc: selinux@tycho.nsa.gov, linux-audit@redhat.com
List-Id: linux-audit@redhat.com

On Tue, 2007-01-30 at 09:49 -0500, Karl MacMillan wrote: 
> Steve Grubb wrote:
> > ausearch -m all --raw | grep anything you want
> 
> tail -f happens to be my favorite counter example, but I am certain 
> there are other useful tricks for monitoring logs that will break. Not 
> to mention the number of log monitoring and aggregation tools that 
> assume text logs.

 To be fair the new audit dispatcher already has a plugin that does the
same thing as "tail -f" without needing to call stat(), and that'll be
released before auditd has binary logs ... although one could certainly
argue that it's not as obvious, it seems like a small price.

-- 
James Antill <jantill@redhat.com>