From 2e59623a490d8c7a4eb568c290fecaab0f30fbb6 Mon Sep 17 00:00:00 2001
From: Walter Lozano <walter.lozano@collabora.com>
Date: Thu, 5 Jan 2023 17:08:06 -0300
Subject: [PATCH] Fix journalctl cursor use
Using --after-cursor in combination with -t audit does produces the expected
output since the filtering logic is applied before and after that the cursor
is moved to next valid entry. In this case, using --after-cursor will cause
the output to miss the first entry in the log.
Fix the issue by using --cursor instead.
Signed-off-by: Walter Lozano <walter.lozano@collabora.com>
---
run-aa-test | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/run-aa-test b/run-aa-test
index d402447..184c8ff 100755
--- a/run-aa-test
+++ b/run-aa-test
@@ -132,7 +132,7 @@ if [ "${UID}" != "0" ]
then
JOURNALCTL="sudo journalctl"
fi
-${JOURNALCTL} --after-cursor "${START_CURSOR}" -t audit -o cat > ${AUDIT_FILE}
+${JOURNALCTL} --cursor "${START_CURSOR}" -t audit -o cat > ${AUDIT_FILE}
echo "#=== ${TEST_TITLE} ==="
--
GitLab