topic Re: audomon -X in Operating System - HP-UX

audomon -X

Tim Yeung_1 — Wed, 18 Mar 2009 23:07:55 GMT

I'm trying to use audomon -X to delete audit log files that are older than 60 days:

audomon -p 20 -t 1 -w 90 -X \
'/usr/bin/find /var/.audit" -mtime +60 -exec rm {} 1;'

But I keep getting the "find: missing conjuction" error everytime audomon runs.

Thanks

Re: audomon -X

James R. Ferguson — Wed, 18 Mar 2009 23:23:53 GMT

Hi Tim:

THe 'find()' command syntax is wrong. I believe that you want:

# audomon -p 20 -t 1 -w 90 -X "/usr/bin/find /var/.audit -type f -mtime +60 -exec rm {} +"

...note that I added the restriction to find only files ('-type f') which should allow the 'rm' to work on all elements found. THe use of the '+' terminator for the '-exec' optimizes the performance.

See the 'find' manpages for more information.

Regards!

...JRF...

Re: audomon -X

Tim Yeung_1 — Wed, 18 Mar 2009 23:38:08 GMT

Still getting "missing conjunction"
I entered exactly what you suggested.
There are spaces between rm, {}, and +

audomon -p 20 -t 1 -w 90 -X "/usr/bin/find /var/.audit -type f -mtime +60 -exec rm {} +"

Re: audomon -X

Dennis Handly — Thu, 19 Mar 2009 04:38:33 GMT

I can't get that -X command to fire off, audomon just keeps running.

Reading audomon(1M) very closely indicates you need to do:
audomon -p 20 -t 1 -w 90 \
-X "/usr/bin/find /var/.audit -type f -mtime +60 -exec rm {} + #"

Where the "#" comments out the useless string "OldTrail".

Or you may want to use: ... -X "/path/to/myscript"
Then myscript can do that find and ignore "OldTrail" in $1.

(That "1;" may have been "\;"??)

Re: audomon -X

Tim Yeung_1 — Thu, 19 Mar 2009 14:51:44 GMT

Yes, it works now. The '#' did it!

In my original note, '1;' was suppose to be '/;'

Thanks.

Re: audomon -X

James R. Ferguson — Thu, 19 Mar 2009 14:59:23 GMT

Hi (again) Tim:

I'm glad Dennis solved this as it was puzzling me. I don't have an audited system nor 11.31 to try.

> In my original note, '1;' was suppose to be '/;'

No, that would have been an escaped semicolon as:

# ... \;

...which when replaced with a '+' improves the performance as I noted, since arguments are bundled and passed as a list/array to the object of the '-exec'.

Regards!

...JRF...

Re: audomon -X

Dennis Handly — Fri, 20 Mar 2009 02:03:01 GMT

>JRF: I don't have an audited system nor 11.31 to try.

I didn't have an audited system but I did have 11.31 and the man page.

Sometimes if you have never heard of the command, you read more closely. :-)