0

I have some audit logs with a date stamp of the format

1532400673.760:2358773

what are the numbers after . and after : represent?

using a website epoch converter 1532400673 converts to GMT: Tuesday, July 24, 2018 2:51:13 AM

if I do date -d @1532400673 I get Mon Jul 23 22:51:13 EDT 2018

but trying to do date -d @1532400673.760:2358773 is invalid format.

  • .### is probably milliseconds the other digit I don't know. GMT and EDT are to different time and they are not the same explaning why you have two different date. – Kiwy Jul 25 '18 at 14:43
  • 1
    which OS ? suse ? redhat ? which audit logs ? – Archemar Jul 25 '18 at 14:44
  • 4
    .760 is likely to be milliseconds. :2358773 is likely not to be part of the timestamp. Without information as to what generates that audit log, it's hard to tell what it might be. – Stéphane Chazelas Jul 25 '18 at 14:44
3

If we dive the source code,

% rpm -qi audit | grep http
Packager    : CentOS BuildSystem <http://bugs.centos.org>
URL         : http://people.redhat.com/sgrubb/audit/
...
% git clone https://github.com/linux-audit/audit-userspace.git
% cd audit-userspace/

And then make a guess that the epoch is a %d flag to printf followed by a colon (it might also be a %ld or %u or %lu depending on whether long or unsigned is for some reason involved):

% grep -ri '%d:' . | tail -1
./auparse/test/auparse_test.py:            print("    event time: %d.%d:%d, host=%s" % (event.sec, event.milli, event.serial, none_to_null(event.host)))

we find some test code that indicates the fields are second, millisecond, and some sort of event serial number. From additional digging it appears these values are grouped together as they all belong to a particular memory structure. Hopefully the docs will have more information about what that serial number is...

  • 1
    See the description of the -a option in ausearch man page. – Stéphane Chazelas Jul 25 '18 at 15:13
  • Usually in dmesg they are since boot time, no idea here. – Rui F Ribeiro Jul 25 '18 at 18:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.