Re: work praudit with tee & grep

2007-08-21 Thread sam
Try the --line-buffered option to grep. I've had a lot of luck with it. Something like the following may work for you: # praudit /etc/auditpipe | grep --line-buffered -e "xxx" If you just want to pipe to a file, use something like: # praudit /etc/auditpipe | grep --line-buffered -e "$" >>

Re: work praudit with tee & grep

2007-08-21 Thread Robert Watson
On Tue, 21 Aug 2007, Eric Crist wrote: thx this not working wite up buffer-pipe to 4096 bytes Can I ask what is in the /etc/auditpipe file? I believe what is meant is /dev/auditpipe, which provides a live event stream from the kernel's audit subsystem in FreeBSD 6.2 and later. You can rea

Re: work praudit with tee & grep

2007-08-21 Thread Eric Crist
On Aug 21, 2007, at 7:52 AMAug 21, 2007, sam wrote: Robert Watson wrote: On Mon, 20 Aug 2007, sam wrote: I am installed AUDIT http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/audit.html # praudit /etc/auditpipe | grep "xxx" & # praudit /etc/auditpipe | tee file.log & # praudit /etc

Re: work praudit with tee & grep

2007-08-21 Thread Eric Crist
On Aug 21, 2007, at 8:21 AMAug 21, 2007, sam wrote: Eric Crist wrote: On Aug 21, 2007, at 7:52 AMAug 21, 2007, sam wrote: Robert Watson wrote: On Mon, 20 Aug 2007, sam wrote: I am installed AUDIT http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/ audit.html # praudit /etc/audit

Re: work praudit with tee & grep

2007-08-21 Thread sam
Eric Crist wrote: On Aug 21, 2007, at 7:52 AMAug 21, 2007, sam wrote: Robert Watson wrote: On Mon, 20 Aug 2007, sam wrote: I am installed AUDIT http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/audit.html # praudit /etc/auditpipe | grep "xxx" & # praudit /etc/auditpipe | tee file.l

Re: work praudit with tee & grep

2007-08-21 Thread sam
Robert Watson wrote: On Mon, 20 Aug 2007, sam wrote: I am installed AUDIT http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/audit.html # praudit /etc/auditpipe | grep "xxx" & # praudit /etc/auditpipe | tee file.log & # praudit /etc/auditpipe > file.log this is not work please help me

Re: work praudit with tee & grep

2007-08-21 Thread Robert Watson
On Mon, 20 Aug 2007, sam wrote: I am installed AUDIT http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/audit.html # praudit /etc/auditpipe | grep "xxx" & # praudit /etc/auditpipe | tee file.log & # praudit /etc/auditpipe > file.log this is not work please help me Vladimir, Could yo