UNIX for Dummies Questions & Answers

Hi Guys,

total newbie here, Ive read through some of the threads about cron and scripts not working and have still drawn a blank as to why mine isnt working correctly.

I have a script that runs the ausearch with a set of criteria i have setup, the only access i have to the system is via puttycm(putty) and su to the root account.

The script checks the audit log for the criteria and dumps it out to a file i have specified, now when I call this from bash it runs fine and creates all the files and populates all the files I expect it to from the files I am watching in auditd.

when I setup cron to do this all the files get created but nothing get populated into them.

Sample script:

Code:

#!/bin/bash

TODAYS=`date +%Y-%m-%d`

mkdir /var/audits/TC/$TODAYS
mkdir /var/audits/Apache/$TODAYS
mkdir /var/audits/Tomcat/$TODAYS

/sbin/ausearch -ua 500 -ts today -k tc-tocs -i > /var/audits/TC/$TODAYS/tc-tocs.txt

from crontab -e:
17 19 * * * /var/audits/script/audits.sh

As you can see I am using absolute paths so i dont think its that, this really has me stumped.

Can anyone lend a hand please?

does '/sbin/ausearch' rely on any environment variables that you're aware of?

If this is Red Hat 5.1 it is a known problem which is fixed in 5.2 (introduced the --input-logs parameter).

Of course if you have the later version you need to specify the --input-logs parameter to stop the program reading from standard input).

I should have mentioned this is running on CentOS 5.2

---------- Post updated at 03:37 PM ---------- Previous update was at 12:24 PM ----------

Are there any other scheduling apps I can try out for CentOS 5.2? as cron seems to be very picky about what it runs, and I cant see any reason why my script is having problems.

Ive even told the /sbin/ausearch the full path to the audit file incase it cant find it, using cron.

strace/truss the command and see if it's successfully opening your audit.log file.

Code:

strace -o /myLog.strace /sbin/ausearch -ua 500 -ts `date +%Y-%m-%d` -k tc-tocs -i

You should find something like:

Code:

open("/var/log/audit/audit.log", O_RDONLY) = 4
access("/var/log/audit/audit.log", R_OK) = 0

Also, try upgrading your audit and audit libs to the latest version to ensure that your ausearch is not under the effects of RH bug 436301.


From the ausearch manpage:

Code:

--input-logs
              Use the log file location from auditd.conf as input for searching. This is needed if you are using ausearch from a cron job.

Well I'm not entirely sure what I changed to get it working but the script is now working,

Thanks for the help guys.