Script that calls ausearch behaves differently when piped data on stdin

Question

Can someone explain why passing a bash script data via STDIN would cause the command within the script to NOT function?

Script:

#!/bin/bash
ausearch          


        

Answer 1

Nothing is wrong with bash, stdin, or your script. ausearch's behavior is the cause.

The ausearch utility can also take input from stdin as long as the input is the raw log data.

See the ausearch manpage: http://man7.org/linux/man-pages/man8/ausearch.8.html

Your script is passing the args just as it should but because of the pipe ausearch is only reading "blah" from stdin and not the default logfiles and giving no matches.

If you need this to not happen use SOMEVAR=$(cat /dev/stdin) to capture stdin in bash and pass it to ausearch or any other part of the script as $SOMEVAR.

Answer 2

ausearch changes its behavior if stdin is a pipe. If it is it searches through stdin rather than through the audit daemon logs. You can use --input-logs to force it to read from the logs.

echo "blah" | ausearch -i -a 1221217 --input-logs

Redirecting stdin would achieve the same end.

#!/bin/bash
ausearch -i -a 1221217 < /dev/null