Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

When SELinux logs an event to the audit log on my CentOS 6 system, it's logging it in epoch time which makes for a real hassle when trying to troubleshoot. Is there any way to make it log these events using human readable date formats? I've looked through the conf files and googled around but can't seem to find anything on it.

share|improve this question

2 Answers 2

up vote 2 down vote accepted

I don't think there are any configuration options, but I found a script that will prepend human readable times:

egrep '^type=(AVC|SELINUX)' /var/log/audit/audit.log |
while read line; do
   time=`echo $line | sed 's/.*audit(\([0-9]*\).*/\1/'`;
   echo `date -d @$time` $line;
done

Source: http://blog.commandlinekungfu.com/2010/08/episode-106-epoch-fail.html

share|improve this answer
    
Thanks. The script works really well! Also, +1 for quanta's script, which works as well just not as much filtering. I was hoping there was a way to make it just write the normal date format when logging but that doesn't seem to be an available option. –  Safado Nov 4 '11 at 17:11

You can use ausearch with -i option to interpret results to be human readable:

# grep -i avc /var/log/audit/audit.log | ausearch -i

Perl code:

# tail -f /var/log/audit/audit.log | perl -pe 's/(\d+)/localtime($1)/e'
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.