ausearch_set_stop - Linux


ausearch_set_stop is a utility for the Linux Audit system that allows administrators to pause and resume audit record generation. It’s commonly used to temporarily stop audit data collection for maintenance or troubleshooting.


ausearch_set_stop [OPTION]... PATH


  • -h, –help: Display usage information and exit.
  • -v, –version: Display version information and exit.
  • -s, –stop: Stop audit record generation.
  • -r, –resume: Resume audit record generation.
  • -t, –timeout=NUM: Set the timeout (in seconds) before the audit system automatically resumes record generation. Default is 0 (disabled).


Stop audit record generation:

ausearch_set_stop -s /var/log/audit

Resume audit record generation:

ausearch_set_stop -r /var/log/audit

Pause audit record generation for 5 minutes:

ausearch_set_stop -t 300 /var/log/audit

Common Issues

  • Ensure that you have root privileges before executing this command.
  • Verify that the specified path is a valid audit log file.
  • When resuming record generation, ensure the path is the same as when it was stopped.


ausearch_set_stop can be used in conjunction with other audit-related commands, such as ausearch and aureport.

For example, you can use ausearch_set_stop to pause audit data collection while running a specific command or script, then resume it afterward to collect any relevant audit records:

ausearch_set_stop -s /var/log/audit
<run command or script>
ausearch_set_stop -r /var/log/audit

Related Commands