Re: ausearch discrepancies?

[LC Bruzenak <lenny@magitekltd.com>]

On Fri, 2009-06-05 at 11:32 -0400, Steve Grubb wrote:
> On Thursday 04 June 2009 08:37:17 pm LC Bruzenak wrote:
> > This shows plenty of events after the 19:11 event shown.
> > Any ideas?
> 
> Looks like a problem. FYI, using aureport shows the exact time range selected 
> for the search. (Aureport and ausearch share the same time code.)
> 
> -Steve

Seems like it is operating true to the man page (earlier email).
No?
I do not agree with the behavior...but agree it is consistent.

Here is my aureport data:

[root@audit audit]# date ;  aureport -ts yesterday -te yesterday -i 
Fri Jun  5 10:38:02 CDT 2009

Summary Report
======================
Range of time in logs: 06/04/2009 00:01:01.595 - 12/31/1969 18:00:00.000
Selected time for report: 06/04/2009 00:00:00 - 06/04/2009 10:38:02
...

But that also has possible issues (something might be wrong with the
range):
[root@audit audit]# ausearch -i -ts 12/31/1969 18:00:00.000 --just-one
Error - year is 1969

[root@audit audit]# ausearch -i | head
----
node=jcdx146 type=PATH msg=audit(06/02/2009 22:21:04.582:3374)

LCB.
 
-- 
LC (Lenny) Bruzenak
lenny@magitekltd.com