Re: excluding auditd events

[Mr Dash Four <mr.dash.four@googlemail.com>]

> Too bad on not using mock; it is in my experience easier than grabbing
> pieces needed and certainly easier when those pieces get revised.
>   
The main reason for not using mock (without drifting too much off topic) 
is because it sets up the chroot environment to mirror the target arch, 
which is not suitable to me at all - the main reason I use 
cross-compilation is to utilise the power of the build machine and its 
architecture - the last think I expected is mock to install GCC and its 
accompanying tools for the (slow) target arch instead of install/build 
them for the build arch with the ability for them to cross-compile.

> $ sudo ausearch -ts 05/30/2011 | less  
> works fine for me on FC10 & RHEL6.
>   
-bash-4.1# ausearch -ts 05/30/2011 | less
Error parsing start date (05/30/2011)

> Look at your system time - is it correct?
> Use the "date" command.
> Check your LC_TIME ENV variable.
>   
-bash-4.1# date
Wed Jun  1 15:41:53 BST 2011
-bash-4.1# echo $LC_TIME

-bash-4.1#

(I am executing this as root as you can imagine).

>> -bash-4.1# ausearch -m AVC -ts "05/26/11" | more <- works!
>>     
>
> $ sudo ausearch -m AVC -ts "05/26/11"
> Error - year is 11
>   
Interesting! I get the desired results and the machine on which this is 
executed has all the latest (and greatest) packages in it, so I am not 
using something which could be considered outdated (even though it is 
all FC13-based a lot of the stuff there is compiled and build from the 
newest available sources).


> This also is the same for me on FC10 & RHEL6 (audit-1.7.16 and
> audit-2.1-5 respectively) . So my guess is your LC_TIME or locale value
> is set for 2-digit dates or something alone those lines. The "date"
> command should yield a clue, especially "date +%x".
>   
-bash-4.1# ausearch --version
ausearch version 2.1.1

-bash-4.1# date +%x
01/06/11