From mboxrd@z Thu Jan  1 00:00:00 1970
From: Steve Grubb <sgrubb@redhat.com>
Subject: Re: ausearch & aureport fail from cron
Date: Fri, 1 Jun 2012 09:16:15 -0400
Message-ID: <201206010916.15621.sgrubb@redhat.com>
References: <112530930.8418.1338388454285.JavaMail.mail@webmail10>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <112530930.8418.1338388454285.JavaMail.mail@webmail10>
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: linux-audit@redhat.com, dean@defreitas.net
List-Id: linux-audit@redhat.com

On Wednesday, May 30, 2012 10:34:14 AM dean@defreitas.net wrote:
>  I am using RHEL 5.8 (upgraded from 5.7) and I can not get these reporting
> tools to work from cron. I have tried many variations to no avail:
> 
> /sbin/ausearch -if /var/log/audit/audit.log  -ts 05/29/2012 00:00:00 -te
> 05/29/2012 23:59:59 > somefile.txt /sbin/ausearch --input-logs -ts
> 05/29/2012 00:00:00 -te 05/29/2012 23:59:59 > somefile.txt cat
> /var/log/audit/audit.log | /sbin/ausearch -ts 05/29/2012 00:00:00 -te
> 05/29/2012 23:59:59 > somefile.txt
> 
> Each of those work from the command line and in a script, but fail when the
> script is run from cron.

You need to pass the "--input-logs" command line option to force it to look at 
the logs instead of stdin.

-Steve