Bug 170412 - ausearch/aureport: '-ts/-te' options require arguments
ausearch/aureport: '-ts/-te' options require arguments
Product: Fedora
Classification: Fedora
Component: audit (Show other bugs)
i686 Linux
medium Severity medium
: ---
: ---
Assigned To: Steve Grubb
Brian Brock
Depends On:
  Show dependency treegraph
Reported: 2005-10-11 10:10 EDT by Tom London
Modified: 2007-11-30 17:11 EST (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2006-01-09 10:53:31 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Tom London 2005-10-11 10:10:19 EDT
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8b5) Gecko/20051008 Fedora/1.5-0.5.0.beta2 Firefox/1.4.1

Description of problem:
The man pages for ausearch/aureport indicate that '-ts' and '-te' can handle omitted dates and times.

Running with both date and time omitted yields:
[root@tlondon log]# aureport -ts
-ts requires either date and/or time
[root@tlondon log]# ausearch -ts 0600
Invalid start date (0600). Month, Day, and Year are required.

man say: 
       -ts [start date] [start time]
              Search for events with time stamps equal to or after  the  given
              end  time. The format of end time depends on your locale. If the
              date is omitted, today is assumed. If the time is omitted,  mid-
              night is assumed. Use 24 hour clock time rather than AM or PM to
              specify time.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. run 'ausearch/aureport' with no args for '-ts/-te'

Additional info:
Comment 1 Steve Grubb 2005-10-11 10:42:46 EDT
At the moment, the ausearch program can assume one or the other, but not both.
Also, the time format should match your locale's format. For example, 06:00:00
should work. I'll look at the code and see how easy it would be to do without
either date or time.
Comment 2 Tom London 2005-12-04 14:36:31 EST
Current version of ausearch (1.1.1) rejects dates (for -ts/-te) using mm/dd/yy
format (as described in manual); it only accepts dates using mm/dd/yyyy format.

Believe the latter is better, so suggest the man page be updated.

Any chance of allowing the string 'today' for a date?
Comment 3 Steve Grubb 2005-12-04 21:22:17 EST
Regarding comment #2, I added code to correctly set the locale just before
1.0.12. To get the old behavior, just set the locale to "C" and it will still
accept 2 digit years. Even though the man page mentions that the format is
locale specific, I'll upate it to be clearer. Thanks.

Note You need to log in before you can comment on or make changes to this bug.