Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
I have some audit logs with a date stamp of the format
1532400673.760:2358773
what are the numbers after . and after : represent?
using a website epoch converter 1532400673 converts to GMT: Tuesday, July 24, 2018 2:51:13 AM
if I do date -d @1532400673 I get Mon Jul 23 22:51:13 EDT 2018
but trying to do date -d @1532400673.760:2358773 is invalid format.
If we dive the source code,
% rpm -qi audit | grep http
Packager : CentOS BuildSystem <http://bugs.centos.org>
URL : http://people.redhat.com/sgrubb/audit/
...
% git clone https://github.com/linux-audit/audit-userspace.git
% cd audit-userspace/
And then make a guess that the epoch is a %d flag to printf followed by a colon (it might also be a %ld or %u or %lu depending on whether long or unsigned is for some reason involved):
% grep -ri '%d:' . | tail -1
./auparse/test/auparse_test.py: print(" event time: %d.%d:%d, host=%s" % (event.sec, event.milli, event.serial, none_to_null(event.host)))
we find some test code that indicates the fields are second, millisecond, and some sort of event serial number. From additional digging it appears these values are grouped together as they all belong to a particular memory structure. Hopefully the docs will have more information about what that serial number is...
-a option in ausearch man page.
Jul 25, 2018 at 15:13
.760is likely to be milliseconds.:2358773is likely not to be part of the timestamp. Without information as to what generates that audit log, it's hard to tell what it might be.