Hi
I set a cron job script to perform ausearch every 5 minutes on a central log
server.
The logs from various hosts are received together in the same file
The logs are rotated on a daily basis
Everything ran fine for several days, then suddently I got :
Corrupted checkpoint file. Inode match, but
Hello all,
I'm happy to announce that lore.kernel.org is now archiving the
linux-audit mailing list (below). The redhat.com archive isn't going
away, so if you are happy with that there is no reason to stop using
it, this is just another archive (always a good idea) with some nice
functionality n
Phillippe,
>From man ausearch .. -ts, --start [start-date] [start-time]
>Search
for events with time stamps equal to or after the given start time. The format
of
start time depends on your locale. You can check the format of your locale by
running date '+%x'. If the
Hi,
I should have read the man more carefully, I missed the checkpoint option on
–ts ☹
I agree it would be better to have one directory per host.
With hosts added dynamically I need to find a way to automate the log rotation
and the cyclic ausearch
Anyway, I saved my day.
Thanks a lot
Philippe
D
