I'm trying to human read
/var/log/audit/audit.log file on centos7. I came with command
sealert -a /var/log/audit/audit.log
which works fine on one machine, there is initial scan which takes second or so, but on another one scan goes on for about 30 minutes and is still on 40%. It cannot be stopped by ctrl-c. I also tried to remove
audit.log so it's almost empty but there was no speedup.
Both of these machines are virtual and run on same host
I found out that many alerts were generated by my apache, so I disabled selinux using
and removed old
audit.log.X files but its still same slow (and keeps slowing so it might never finish)
sealert process is using one core permanently at 25% of CPU and 1gig of RAM.
is there any other way I can analyze selinux log files from cli ?