Add note about boot time option

caidongyun · Aug 17, 2018 · e98bfbf · e98bfbf
1 parent ca7e553
commit e98bfbf
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 0 deletions.
diff --git a/docs/aureport.8 b/docs/aureport.8
@@ -129,6 +129,11 @@ Report about Virtualization events
 .BR \-x ,\  \-\-executable
 Report about executables
 
+.SH NOTE
+The boot time option is a convenience function and has limitations. The time it calculates is based on time now minus /proc/uptime. If after boot the system clock has been adjusted, perhaps by ntp, then the calculation may be wrong. In that case you'll need to fully specify the time. You can check the time it would use by running:
+
+date -d "`cut \-f1 \-d. /proc/uptime` seconds ago"
+
 .SH "SEE ALSO"
 .BR ausearch (8),
 .BR auditd (8).
diff --git a/docs/ausearch.8 b/docs/ausearch.8
@@ -225,6 +225,11 @@ checkpoint processing error
 .TP
 12
 checkpoint event not found in matching log file
+.SH NOTE
+The boot time option is a convenience function and has limitations. The time it calculates is based on time now minus /proc/uptime. If after boot the system clock has been adjusted, perhaps by ntp, then the calculation may be wrong. In that case you'll need to fully specify the time. You can check the time it would use by running:
+
+date -d "`cut \-f1 \-d. /proc/uptime` seconds ago"
+
 .SH "SEE ALSO"
 .BR auditd (8),
 .BR pam_loginuid (8).