audomon -X

[Tim Yeung_1]

I'm trying to use audomon -X to delete audit log files that are older than 60 days:

audomon -p 20 -t 1 -w 90 -X \
'/usr/bin/find /var/.audit" -mtime +60 -exec rm {} 1;'

But I keep getting the "find: missing conjuction" error everytime audomon runs.

Thanks

[James R. Ferguson]

Hi Tim:

THe 'find()' command syntax is wrong. I believe that you want:

# audomon -p 20 -t 1 -w 90 -X "/usr/bin/find /var/.audit -type f -mtime +60 -exec rm {} +"

...note that I added the restriction to find only files ('-type f') which should allow the 'rm' to work on all elements found. THe use of the '+' terminator for the '-exec' optimizes the performance.

See the 'find' manpages for more information.

Regards!

...JRF...

[Tim Yeung_1]

Still getting "missing conjunction"
I entered exactly what you suggested.
There are spaces between rm, {}, and +

audomon -p 20 -t 1 -w 90 -X "/usr/bin/find /var/.audit -type f -mtime +60 -exec rm {} +"

[Dennis Handly · Accepted solution]

I can't get that -X command to fire off, audomon just keeps running.

Reading audomon(1M) very closely indicates you need to do:
audomon -p 20 -t 1 -w 90 \
-X "/usr/bin/find /var/.audit -type f -mtime +60 -exec rm {} + #"

Where the "#" comments out the useless string "OldTrail".

Or you may want to use: ... -X "/path/to/myscript"
Then myscript can do that find and ignore "OldTrail" in $1.

(That "1;" may have been "\;"??)

[Tim Yeung_1]

Yes, it works now. The '#' did it!

In my original note, '1;' was suppose to be '/;'

Thanks.

[James R. Ferguson]

Hi (again) Tim:

I'm glad Dennis solved this as it was puzzling me. I don't have an audited system nor 11.31 to try.

> In my original note, '1;' was suppose to be '/;'

No, that would have been an escaped semicolon as:

# ... \;

...which when replaced with a '+' improves the performance as I noted, since arguments are bundled and passed as a list/array to the object of the '-exec'.

Regards!

...JRF...

[Dennis Handly]

>JRF: I don't have an audited system nor 11.31 to try.

I didn't have an audited system but I did have 11.31 and the man page.

Sometimes if you have never heard of the command, you read more closely. :-)