From mboxrd@z Thu Jan 1 00:00:00 1970 From: LC Bruzenak Subject: Re: ausearch discrepancies? Date: Fri, 05 Jun 2009 10:42:18 -0500 Message-ID: <1244216538.31664.526.camel@homeserver> References: <1244162237.31664.477.camel@homeserver> <200906051132.35757.sgrubb@redhat.com> Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <200906051132.35757.sgrubb@redhat.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Steve Grubb Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Fri, 2009-06-05 at 11:32 -0400, Steve Grubb wrote: > On Thursday 04 June 2009 08:37:17 pm LC Bruzenak wrote: > > This shows plenty of events after the 19:11 event shown. > > Any ideas? > > Looks like a problem. FYI, using aureport shows the exact time range selected > for the search. (Aureport and ausearch share the same time code.) > > -Steve Seems like it is operating true to the man page (earlier email). No? I do not agree with the behavior...but agree it is consistent. Here is my aureport data: [root@audit audit]# date ; aureport -ts yesterday -te yesterday -i Fri Jun 5 10:38:02 CDT 2009 Summary Report ====================== Range of time in logs: 06/04/2009 00:01:01.595 - 12/31/1969 18:00:00.000 Selected time for report: 06/04/2009 00:00:00 - 06/04/2009 10:38:02 ... But that also has possible issues (something might be wrong with the range): [root@audit audit]# ausearch -i -ts 12/31/1969 18:00:00.000 --just-one Error - year is 1969 [root@audit audit]# ausearch -i | head ---- node=jcdx146 type=PATH msg=audit(06/02/2009 22:21:04.582:3374) LCB. -- LC (Lenny) Bruzenak lenny@magitekltd.com