From Bugzilla Helper: User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8b5) Gecko/20051008 Fedora/1.5-0.5.0.beta2 Firefox/1.4.1 Description of problem: The man pages for ausearch/aureport indicate that '-ts' and '-te' can handle omitted dates and times. Running with both date and time omitted yields: [root@tlondon log]# aureport -ts -ts requires either date and/or time [root@tlondon log]# ausearch -ts 0600 Invalid start date (0600). Month, Day, and Year are required. man say: -ts [start date] [start time] Search for events with time stamps equal to or after the given end time. The format of end time depends on your locale. If the date is omitted, today is assumed. If the time is omitted, mid- night is assumed. Use 24 hour clock time rather than AM or PM to specify time. Version-Release number of selected component (if applicable): audit-1.0.5-1 How reproducible: Always Steps to Reproduce: 1. run 'ausearch/aureport' with no args for '-ts/-te' 2. 3. Additional info:
At the moment, the ausearch program can assume one or the other, but not both. Also, the time format should match your locale's format. For example, 06:00:00 should work. I'll look at the code and see how easy it would be to do without either date or time.
Current version of ausearch (1.1.1) rejects dates (for -ts/-te) using mm/dd/yy format (as described in manual); it only accepts dates using mm/dd/yyyy format. Believe the latter is better, so suggest the man page be updated. Any chance of allowing the string 'today' for a date?
Regarding comment #2, I added code to correctly set the locale just before 1.0.12. To get the old behavior, just set the locale to "C" and it will still accept 2 digit years. Even though the man page mentions that the format is locale specific, I'll upate it to be clearer. Thanks.