ausearch_set_stop - Linux

Overview

ausearch_set_stop is a utility for the Linux Audit system that allows administrators to pause and resume audit record generation. It’s commonly used to temporarily stop audit data collection for maintenance or troubleshooting.

Syntax

ausearch_set_stop [OPTION]... PATH

Options/Flags

  • -h, –help: Display usage information and exit.
  • -v, –version: Display version information and exit.
  • -s, –stop: Stop audit record generation.
  • -r, –resume: Resume audit record generation.
  • -t, –timeout=NUM: Set the timeout (in seconds) before the audit system automatically resumes record generation. Default is 0 (disabled).

Examples

Stop audit record generation:

ausearch_set_stop -s /var/log/audit

Resume audit record generation:

ausearch_set_stop -r /var/log/audit

Pause audit record generation for 5 minutes:

ausearch_set_stop -t 300 /var/log/audit

Common Issues

  • Ensure that you have root privileges before executing this command.
  • Verify that the specified path is a valid audit log file.
  • When resuming record generation, ensure the path is the same as when it was stopped.

Integration

ausearch_set_stop can be used in conjunction with other audit-related commands, such as ausearch and aureport.

For example, you can use ausearch_set_stop to pause audit data collection while running a specific command or script, then resume it afterward to collect any relevant audit records:

ausearch_set_stop -s /var/log/audit
<run command or script>
ausearch_set_stop -r /var/log/audit

Related Commands