From owner-freebsd-hackers@FreeBSD.ORG  Tue Aug 21 13:36:06 2007
Return-Path: <owner-freebsd-hackers@FreeBSD.ORG>
Delivered-To: freebsd-hackers@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 2B8C316A417
	for <freebsd-hackers@freebsd.org>; Tue, 21 Aug 2007 13:36:06 +0000 (UTC)
	(envelope-from samflanker@gmail.com)
Received: from nf-out-0910.google.com (nf-out-0910.google.com [64.233.182.184])
	by mx1.freebsd.org (Postfix) with ESMTP id 79FE913C46A
	for <freebsd-hackers@freebsd.org>; Tue, 21 Aug 2007 13:36:05 +0000 (UTC)
	(envelope-from samflanker@gmail.com)
Received: by nf-out-0910.google.com with SMTP id b2so948332nfb
	for <freebsd-hackers@freebsd.org>; Tue, 21 Aug 2007 06:36:04 -0700 (PDT)
DKIM-Signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta;
	h=domainkey-signature:received:received:message-id:date:from:user-agent:mime-version:to:cc:subject:references:in-reply-to:content-type:content-transfer-encoding;
	b=fuw4hVEO87PTwjf53wY/RT3dw1f4873c6vAys/CBo924Htg55GztqqjHZGUPGtq5ZmUg5lddeaVuMNSQgORW2XxARRJOJmOMN8ILp8BFOT99BmaXYHREWT2n2q9wvqD0ga2fqlkOpo7U7wVvtM4DFnWjyfqJ7NUi0hvQVj1AI0k=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta;
	h=received:message-id:date:from:user-agent:mime-version:to:cc:subject:references:in-reply-to:content-type:content-transfer-encoding;
	b=CvPcRM2Cm29BrKwG1w6UzRxFznwZi5N8w1b61diwnx90pA7Lp77sUqukf7SG4/quD/1rq6M7cFPUnzeOGcw8LB04JwuFRGJFvuxwHqe09mLHDEbg6F+0m9xGtHisxQ1ioWfAXZ5JftucZzxnoMoF3X4WwI2BJbZSDXxQe+A1PnI=
Received: by 10.86.71.1 with SMTP id t1mr5449992fga.1187703363841;
	Tue, 21 Aug 2007 06:36:03 -0700 (PDT)
Received: from ?192.168.1.185? ( [213.152.137.35])
	by mx.google.com with ESMTPS id 22sm11958163fkr.2007.08.21.06.36.03
	(version=SSLv3 cipher=RC4-MD5); Tue, 21 Aug 2007 06:36:03 -0700 (PDT)
Message-ID: <46CAEA34.40409@gmail.com>
Date: Tue, 21 Aug 2007 17:35:48 +0400
From: sam <samflanker@gmail.com>
User-Agent: Thunderbird 2.0.0.4 (Windows/20070604)
MIME-Version: 1.0
To: Eric Crist <mnslinky@gmail.com>
References: <46C9528D.8010201@gmail.com>
	<20070821123943.N50579@fledge.watson.org>
	<46CADFF9.2000700@gmail.com>
	<C48660DC-BD8A-4D38-A0BC-4707921E4799@gmail.com>
	<46CAE6C7.5060706@gmail.com>
	<80FA5D23-FA4E-4D1D-87E8-B06E4931C48D@gmail.com>
In-Reply-To: <80FA5D23-FA4E-4D1D-87E8-B06E4931C48D@gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Cc: freebsd-hackers@freebsd.org, Robert Watson <rwatson@FreeBSD.org>
Subject: Re: work praudit with tee & grep
X-BeenThere: freebsd-hackers@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Technical Discussions relating to FreeBSD
	<freebsd-hackers.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-hackers>, 
	<mailto:freebsd-hackers-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-hackers>
List-Post: <mailto:freebsd-hackers@freebsd.org>
List-Help: <mailto:freebsd-hackers-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-hackers>,
	<mailto:freebsd-hackers-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 21 Aug 2007 13:36:06 -0000


>>> Try the --line-buffered option to grep.  I've had a lot of luck with 
>>> it.  Something like the following may work for you:
>>>
>>> # praudit /etc/auditpipe | grep --line-buffered -e "xxx"
>>>
>>> If you just want to pipe to a file, use something like:
>>>
>>> # praudit /etc/auditpipe | grep --line-buffered -e "$" >> file.log
>>>
>>> HTH
>>> -----
>>> Eric F Crist
>>> Secure Computing Networks
>>>
>>>
>>>
>> thx
>> this not working
>> wite up buffer-pipe to 4096 bytes
>>
>
> Can I ask what is in the /etc/auditpipe file?
>
> -----
> Eric F Crist
> Secure Computing Networks
>
>
>
# ls -l /etc/auditpipe
ls: /etc/auditpipe: No such file or directory
# ls -l /dev/auditpipe
crw-------  1 root  wheel    1,  92 Aug 17 11:05 /dev/auditpipe

/Vladimir Ermakov