From: Burn Alting <burn.alting@iinet.net.au>
To: Lenny Bruzenak <lenny@magitekltd.com>, Linux-audit@redhat.com
Subject: Re: checkpoint question
Date: Thu, 18 Mar 2021 19:33:30 +1100 [thread overview]
Message-ID: <c12f30e3a815ad9c934a3beda51a1dc01d7063c2.camel@iinet.net.au> (raw)
In-Reply-To: <37100363-f625-7b87-4b23-4074f697d465@magitekltd.com>
[-- Attachment #1.1: Type: text/plain, Size: 799 bytes --]
Lenny,
When checkpoint was initially added, such activity (one by one event consumption)
was not envisaged. If this is needed I can look into providing it.
Pls advise.
Rgds
Burn
On Wed, 2021-03-17 at 19:02 -0500, Lenny Bruzenak wrote:
> I'm trying to use the ausearch checkpoint feature in conjunction with
> the "--just-one" option in order to parse some events one at a time.
>
> However, using this I only get the first event (audit 2.8.5).
>
> IOW I'm doing:
>
> # let CNT=10
>
> # while [ $CNT -gt 0 ] ; do
>
> > auditctl -m "Event $CNT"
>
> > let CNT=$CNT-1
>
> > done
>
> # ausearch -i -ts recent --checkpoint /tmp/check --just-one -m user
>
> < Returns event 10 >
>
> but
>
> # ausearch -i --checkpoint /tmp/check --just-one -m user
>
> <no matches>
>
>
> Thx,
>
> LCB
>
[-- Attachment #1.2: Type: text/html, Size: 1776 bytes --]
[-- Attachment #2: Type: text/plain, Size: 106 bytes --]
--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit
prev parent reply other threads:[~2021-03-18 8:36 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-18 0:02 checkpoint question Lenny Bruzenak
2021-03-18 8:33 ` Burn Alting [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=c12f30e3a815ad9c934a3beda51a1dc01d7063c2.camel@iinet.net.au \
--to=burn.alting@iinet.net.au \
--cc=Linux-audit@redhat.com \
--cc=burn@swtf.dyndns.org \
--cc=lenny@magitekltd.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).