Bug 2059088

Summary: More robust handling of the --input flag for audit CLI tools, e.g. aureport
Product: Red Hat Enterprise Linux 9 Reporter: Apurbita Mukherjee <apmukher>
Component: auditAssignee: Sergio Correia <scorreia>
Status: NEW --- QA Contact: BaseOS QE Security Team <qe-baseos-security>
Severity: low Docs Contact:
Priority: low    
Version: 9.0CC: sgrubb
Target Milestone: rcKeywords: FutureFeature, Triaged
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Enhancement
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: Feature Request
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Comment 1 Steve Grubb 2022-02-28 13:46:01 UTC 
The ausearch/aureport applications support being passed a directory. The naming scheme for all of auditd's logs is that they have a number appended to the file name to indicate an ordering. The file name must match the filename in auditd.conf's log_file config option. Typically it's audit.log. The number appended is sequential with the largest number being the oldest log. In the case that the log is the current log being written to, it shall not have a number appended. If the files conform to this, it works today.

The only problem comes when someone decides they want to reorganize the files by appending some other numbering scheme to the files. How do you accommodate all possible numbering schemes?