auditd script through crontab - bad date

Question

I did create a central auditd server where i'am sending all audit logs form local servers.

I would like reports accesses from a specific node.

So I created a simple report sript where one line is something like : ausearch -n XXXXX | aureport -i

It is sheduled like this : 0 */4 * * * root /home/XXXX/report.sh

Permission are : -rwxr-xr-x 1 root root 743 Feb 10 11:27 report.sh

When I execute script from shell , everithing looks OK , I did recived mail with log output :

Summary Report
======================
Range of time in logs: **02/22/2017 23:24:09.603 - 02/24/2017 10:16:26.313**
Selected time for report: **02/22/2017 23:24:09 - 02/24/2017 10:16:26.313**
Number of changes in configuration: 0
Number of changes to accounts, groups, or roles: 0
Number of logins: 22
Number of failed logins: 2
Number of authentications: 54
Number of failed authentications: 0
Number of users: 5
Number of terminals: 4
Number of host names: 4
Number of executables: 14
Number of commands: 21
Number of files: 101
Number of AVC's: 0
Number of MAC events: 0
Number of failed syscalls: 20
Number of anomaly events: 0
Number of responses to anomaly events: 0
Number of crypto events: 256
Number of integrity events: 0
Number of virt events: 0
Number of keys: 1
Number of process IDs: 25087
Number of events: 96620

But problem is that when I shedule it through crontab. Then i recieve bad date and time with no events ... Something like this :

Summary Report
======================
Range of time in logs: **01/01/1970 01:00:00.000 - 01/01/1970 01:00:00.000**
Selected time for report: **01/01/1970 01:00:00 - 01/01/1970 01:00:00.000**
Number of changes in configuration: 0
Number of changes to accounts, groups, or roles: **0**
Number of logins: **0**
Number of failed logins: **0**
Number of authentications: **0**
Number of failed authentications: **0**
Number of users: **0**
Number of terminals: **0**
Number of host names: **0**
Number of executables: **0**
Number of commands: **0**
Number of files: **0**
Number of AVC's: **0**
Number of MAC events: **0**
Number of failed syscalls: **0**
Number of anomaly events: **0**
Number of responses to anomaly events: **0**
Number of crypto events: **0**
Number of integrity events: **0**

My Linux version : Linux version 3.10.0-514.2.2.el7.x86_64 ([email protected]) (gcc version 4.8.5 20150623 (Red Hat 4.8.5-11) (GCC) ) #1 SMP Tue Dec 6 23:06:41 UTC 2016

Any idea why this happened ?

Answer 1

cron runs with a restricted enviroment, you must extend it. Set the PATH variable to the same value as your current enviroment. crontab example:

PATH=/home/xxxxx/bin:/usr/local/bin:/usr/bin:/bin
SHELL=/bin/zsh
MAILTO=xxxxx
#
# minute  0-59
# hour    0-23
# dom     1-31
# mon     1-12 (or names)
# dow     0-7  (0 or 7 is Sun, or use names)
#
# mm hh dom mon dow command
*    *  *   *   *   set > /tmp/cronenv

Use set > /tmp/myenv to compare your and crons enviroment or trace the usage with ltrace -egetenv.