On Fri, 2009-06-05 at 11:32 -0400, Steve Grubb wrote: > On Thursday 04 June 2009 08:37:17 pm LC Bruzenak wrote: > > This shows plenty of events after the 19:11 event shown. > > Any ideas? > > Looks like a problem. FYI, using aureport shows the exact time range selected > for the search. (Aureport and ausearch share the same time code.) > > -Steve
Seems like it is operating true to the man page (earlier email). No? I do not agree with the behavior...but agree it is consistent. Here is my aureport data: [r...@audit audit]# date ; aureport -ts yesterday -te yesterday -i Fri Jun 5 10:38:02 CDT 2009 Summary Report ====================== Range of time in logs: 06/04/2009 00:01:01.595 - 12/31/1969 18:00:00.000 Selected time for report: 06/04/2009 00:00:00 - 06/04/2009 10:38:02 ... But that also has possible issues (something might be wrong with the range): [r...@audit audit]# ausearch -i -ts 12/31/1969 18:00:00.000 --just-one Error - year is 1969 [r...@audit audit]# ausearch -i | head ---- node=jcdx146 type=PATH msg=audit(06/02/2009 22:21:04.582:3374) LCB. -- LC (Lenny) Bruzenak [email protected] -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
