Linux-audit Archive on lore.kernel.org
 help / color / Atom feed
* checkpoint question
@ 2021-03-18  0:02 Lenny Bruzenak
  2021-03-18  8:33 ` Burn Alting
  0 siblings, 1 reply; 2+ messages in thread
From: Lenny Bruzenak @ 2021-03-18  0:02 UTC (permalink / raw)
  To: Linux-audit

I'm trying to use the ausearch checkpoint feature in conjunction with
the "--just-one" option in order to parse some events one at a time.

However, using this I only get the first event (audit 2.8.5).

IOW I'm doing:

# let CNT=10

# while [ $CNT -gt 0 ] ; do

> auditctl -m "Event $CNT"

> let CNT=$CNT-1

> done

# ausearch -i -ts recent --checkpoint /tmp/check --just-one -m user

< Returns event 10 >

but

# ausearch -i --checkpoint /tmp/check --just-one -m user

<no matches>


Thx,

LCB

-- 
Lenny Bruzenak
MagitekLTD

--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit


^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: checkpoint question
  2021-03-18  0:02 checkpoint question Lenny Bruzenak
@ 2021-03-18  8:33 ` Burn Alting
  0 siblings, 0 replies; 2+ messages in thread
From: Burn Alting @ 2021-03-18  8:33 UTC (permalink / raw)
  To: Lenny Bruzenak, Linux-audit

[-- Attachment #1.1: Type: text/plain, Size: 799 bytes --]

Lenny,

When checkpoint was initially added, such activity (one by one event consumption)
was not envisaged. If this is needed I can look into providing it.

Pls advise.

Rgds

Burn
On Wed, 2021-03-17 at 19:02 -0500, Lenny Bruzenak wrote:
> I'm trying to use the ausearch checkpoint feature in conjunction with
> the "--just-one" option in order to parse some events one at a time.
> 
> However, using this I only get the first event (audit 2.8.5).
> 
> IOW I'm doing:
> 
> # let CNT=10
> 
> # while [ $CNT -gt 0 ] ; do
> 
> > auditctl -m "Event $CNT"
> 
> > let CNT=$CNT-1
> 
> > done
> 
> # ausearch -i -ts recent --checkpoint /tmp/check --just-one -m user
> 
> < Returns event 10 >
> 
> but
> 
> # ausearch -i --checkpoint /tmp/check --just-one -m user
> 
> <no matches>
> 
> 
> Thx,
> 
> LCB
> 

[-- Attachment #1.2: Type: text/html, Size: 1776 bytes --]

[-- Attachment #2: Type: text/plain, Size: 106 bytes --]

--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit

^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, back to index

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-03-18  0:02 checkpoint question Lenny Bruzenak
2021-03-18  8:33 ` Burn Alting

Linux-audit Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-audit/0 linux-audit/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-audit linux-audit/ https://lore.kernel.org/linux-audit \
		linux-audit@redhat.com
	public-inbox-index linux-audit

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/com.redhat.linux-audit


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git