* checkpoint question
@ 2021-03-18 0:02 Lenny Bruzenak
2021-03-18 8:33 ` Burn Alting
0 siblings, 1 reply; 2+ messages in thread
From: Lenny Bruzenak @ 2021-03-18 0:02 UTC (permalink / raw)
To: Linux-audit
I'm trying to use the ausearch checkpoint feature in conjunction with
the "--just-one" option in order to parse some events one at a time.
However, using this I only get the first event (audit 2.8.5).
IOW I'm doing:
# let CNT=10
# while [ $CNT -gt 0 ] ; do
> auditctl -m "Event $CNT"
> let CNT=$CNT-1
> done
# ausearch -i -ts recent --checkpoint /tmp/check --just-one -m user
< Returns event 10 >
but
# ausearch -i --checkpoint /tmp/check --just-one -m user
<no matches>
Thx,
LCB
--
Lenny Bruzenak
MagitekLTD
--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: checkpoint question
2021-03-18 0:02 checkpoint question Lenny Bruzenak
@ 2021-03-18 8:33 ` Burn Alting
0 siblings, 0 replies; 2+ messages in thread
From: Burn Alting @ 2021-03-18 8:33 UTC (permalink / raw)
To: Lenny Bruzenak, Linux-audit
[-- Attachment #1.1: Type: text/plain, Size: 799 bytes --]
Lenny,
When checkpoint was initially added, such activity (one by one event consumption)
was not envisaged. If this is needed I can look into providing it.
Pls advise.
Rgds
Burn
On Wed, 2021-03-17 at 19:02 -0500, Lenny Bruzenak wrote:
> I'm trying to use the ausearch checkpoint feature in conjunction with
> the "--just-one" option in order to parse some events one at a time.
>
> However, using this I only get the first event (audit 2.8.5).
>
> IOW I'm doing:
>
> # let CNT=10
>
> # while [ $CNT -gt 0 ] ; do
>
> > auditctl -m "Event $CNT"
>
> > let CNT=$CNT-1
>
> > done
>
> # ausearch -i -ts recent --checkpoint /tmp/check --just-one -m user
>
> < Returns event 10 >
>
> but
>
> # ausearch -i --checkpoint /tmp/check --just-one -m user
>
> <no matches>
>
>
> Thx,
>
> LCB
>
[-- Attachment #1.2: Type: text/html, Size: 1776 bytes --]
[-- Attachment #2: Type: text/plain, Size: 106 bytes --]
--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-03-18 8:36 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-03-18 0:02 checkpoint question Lenny Bruzenak
2021-03-18 8:33 ` Burn Alting
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.