From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: buffer space Date: Mon, 17 Aug 2009 14:01:05 -0400 Message-ID: <200908171401.11835.sgrubb@redhat.com> References: <1250531163.3048.720.camel@homeserver> Mime-Version: 1.0 Content-Type: Text/Plain; charset="iso-8859-15" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <1250531163.3048.720.camel@homeserver> Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: LC Bruzenak Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Monday 17 August 2009 01:46:03 pm LC Bruzenak wrote: > > UGH this is a wrench in the works... > > I was hoping to grab all the rotated logs, process them while still > > allowing audit > > to run with no interruptions. Problem I run into is I run ausearch -i > > > > > /tmp/file and then > > > > do ausearch -i /nfs/file with auditd stopped, then compare files and > > if they are the same in > > size then delete the /tmp/file. I do this to make sure I get the log > > in the nfs archive directory > > and the /tmp is a backup if there is a problem. If audit is running > > there is no way the files will > > be equal in size while processing the /var/log/audit data in two > > different intervals. > > It's a problem for me too. > I was thinking about just patching the ausearch code to behave as > desired...but hoping Steve beat me to it so there was a greatly reduced > chance of bad code... #cat `ls /var/log/audit/a* | sort -r` | ausearch -i #cat `ls /var/log/audit/a* | sort -r` | aureport cat can open more than one file at a time, -Steve