From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Norman Mark St. Laurent" Subject: Re: buffer space Date: Mon, 17 Aug 2009 14:46:30 -0400 Message-ID: <4A89A586.9020008@conceras.com> References: <1250531163.3048.720.camel@homeserver> <200908171401.11835.sgrubb@redhat.com> <1250532894.3048.729.camel@homeserver> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Return-path: Received: from mx3.redhat.com (mx3.redhat.com [172.16.48.32]) by int-mx1.corp.redhat.com (8.13.1/8.13.1) with ESMTP id n7HIlKCj004522 for ; Mon, 17 Aug 2009 14:47:20 -0400 Received: from smtpauth16.prod.mesa1.secureserver.net (smtpauth16.prod.mesa1.secureserver.net [64.202.165.22]) by mx3.redhat.com (8.13.8/8.13.8) with SMTP id n7HIl3RW003383 for ; Mon, 17 Aug 2009 14:47:03 -0400 In-Reply-To: <1250532894.3048.729.camel@homeserver> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: LC Bruzenak Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com Depending if you are using logrotate.d/audit and how it numbers the files as it rotates... audit.log.1.gz audit.log.2.gz ... audit.log.89.gz audit.log.90.gz The sort below will but the list in exact order.... zcat `ls /var/log/audit/*.gz | sort -t. --key=3,2n` | ausearch -i Thank u Steve... Norman Mark St. Laurent Conceras | Chief Technology Officer and ISSE Web: http://www.conceras.com Connect. Collaborate. Conceras. LC Bruzenak wrote: > On Mon, 2009-08-17 at 14:01 -0400, Steve Grubb wrote: > >>> It's a problem for me too. >>> I was thinking about just patching the ausearch code to behave as >>> desired...but hoping Steve beat me to it so there was a greatly >>> >> reduced >> >>> chance of bad code... >>> >> #cat `ls /var/log/audit/a* | sort -r` | ausearch -i >> #cat `ls /var/log/audit/a* | sort -r` | aureport >> >> cat can open more than one file at a time, >> >> -Steve >> > > Told you so! > :) > > LCB. > >