I did create a central auditd server where i'am sending all audit logs form local servers.

I would like reports accesses from a specific node.

So I created a simple report sript where one line is something like : ausearch -n XXXXX | aureport -i

It is sheduled like this : 0 */4 * * * root /home/XXXX/report.sh

Permission are : -rwxr-xr-x 1 root root 743 Feb 10 11:27 report.sh

When I execute script from shell , everithing looks OK , I did recived mail with log output :

Summary Report
======================
Range of time in logs: **02/22/2017 23:24:09.603 - 02/24/2017 10:16:26.313**
Selected time for report: **02/22/2017 23:24:09 - 02/24/2017 10:16:26.313**
Number of changes in configuration: 0
Number of changes to accounts, groups, or roles: 0
Number of logins: 22
Number of failed logins: 2
Number of authentications: 54
Number of failed authentications: 0
Number of users: 5
Number of terminals: 4
Number of host names: 4
Number of executables: 14
Number of commands: 21
Number of files: 101
Number of AVC's: 0
Number of MAC events: 0
Number of failed syscalls: 20
Number of anomaly events: 0
Number of responses to anomaly events: 0
Number of crypto events: 256
Number of integrity events: 0
Number of virt events: 0
Number of keys: 1
Number of process IDs: 25087
Number of events: 96620

But problem is that when I shedule it through crontab. Then i recieve bad date and time with no events ... Something like this :

Summary Report
======================
Range of time in logs: **01/01/1970 01:00:00.000 - 01/01/1970 01:00:00.000**
Selected time for report: **01/01/1970 01:00:00 - 01/01/1970 01:00:00.000**
Number of changes in configuration: 0
Number of changes to accounts, groups, or roles: **0**
Number of logins: **0**
Number of failed logins: **0**
Number of authentications: **0**
Number of failed authentications: **0**
Number of users: **0**
Number of terminals: **0**
Number of host names: **0**
Number of executables: **0**
Number of commands: **0**
Number of files: **0**
Number of AVC's: **0**
Number of MAC events: **0**
Number of failed syscalls: **0**
Number of anomaly events: **0**
Number of responses to anomaly events: **0**
Number of crypto events: **0**
Number of integrity events: **0**

My Linux version : Linux version 3.10.0-514.2.2.el7.x86_64 (builder@kbuilder.dev.centos.org) (gcc version 4.8.5 20150623 (Red Hat 4.8.5-11) (GCC) ) #1 SMP Tue Dec 6 23:06:41 UTC 2016

Any idea why this happened ?

cron runs with a restricted enviroment, you must extend it. Set the PATH variable to the same value as your current enviroment. crontab example:

PATH=/home/xxxxx/bin:/usr/local/bin:/usr/bin:/bin
SHELL=/bin/zsh
MAILTO=xxxxx
#
# minute  0-59
# hour    0-23
# dom     1-31
# mon     1-12 (or names)
# dow     0-7  (0 or 7 is Sun, or use names)
#
# mm hh dom mon dow command
*    *  *   *   *   set > /tmp/cronenv

Use set > /tmp/myenv to compare your and crons enviroment or trace the usage with ltrace -egetenv.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.