Bug 433282 - aureport uses standard input when run from cron
aureport uses standard input when run from cron
Status: CLOSED DUPLICATE of bug 432866
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: audit (Show other bugs)
5.1
i386 Linux
medium Severity high
: rc
: ---
Assigned To: Steve Grubb
Brian Brock
:
Depends On: 428860
Blocks:
  Show dependency treegraph
 
Reported: 2008-02-18 06:20 EST by Martin Poole
Modified: 2008-02-18 14:45 EST (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-02-18 14:45:43 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Martin Poole 2008-02-18 06:20:26 EST
+++ This bug was initially created as a clone of Bug #428860 +++

Description of problem:

When aureport is run from a file in /etc/cron.hourly or /etc/cron.daily, it uses
standard input for input rather than /var/log/audit/audit.log.  It finds no log
records on standard input.


Version-Release number of selected component (if applicable):
audit-1.6.2-4.fc8

How reproducible:
every time

Steps to Reproduce:
1.Create a file in /etc/cron.daily or /etc/cron.hourly to run aureport
2.Wait for cron to run the file
3.
  
Actual results:
No data is seen by aureport

Expected results:
aureport processes the data in /var/log/audit/audit.log

Additional info:

The following check is done in aureport.c:

        if (input_is_pipe())
                rc = process_stdin();
        else if (user_file)
                rc = process_file(user_file);
        else
                rc = process_logs(&config);

When a job is run by cron, standard input is set to a pipe so the pipe is used
ranther than the files, even if the -if option is given on the aureport command.

-- Additional comment from sgrubb@redhat.com on 2008-01-28 18:04 EST --
I added --input-logs to audit-1.6.7 development code. It should be released
within a few weeks.

-- Additional comment from sgrubb@redhat.com on 2008-01-31 18:43 EST --
audit-1.6.7-1 was built into rawhide and F-8 testing. The new option should
solve the problem. Thanks for reporting the bug!
Comment 1 Martin Poole 2008-02-18 06:21:25 EST
Customer is reporting against RHEL5 version

audit-1.5.5-7.el5-x86_64
Comment 2 Steve Grubb 2008-02-18 12:20:04 EST
I am already working this item under bz #432866.
Comment 3 Steve Grubb 2008-02-18 14:45:43 EST

*** This bug has been marked as a duplicate of 432866 ***

Note You need to log in before you can comment on or make changes to this bug.