I'm not able to redirect output of command into a file when ran with cronjob  [root@mail /]# crontab -l  */1   *   *     *   *    /sbin/ausearch -i  >  /rummy[root@mail /]# cat /rummyIt's weird that when I dont give -i option , I'm able to redirect it very well.[root@mail /]# crontab -l  */1 *   *   *   *   /sbin/ausearch > /rummy[root@mail /]# cat /rummy  usage: ausearch [options]    -a,--event <Audit event id> search based on audit event id      --arch <CPU>            search based on the CPU architecture      -c,--comm  <Comm name>      search based on command line name      -      -      -  It there any syntax error or I'm missing here something?  Note - ausearch -i fetches me below output on terminal and on redirecting output to file , it redirects it as it is.    [root@server ~]# ausearch -i  type=DAEMON_START msg=audit(05/22/2017 11:14:10.391:6858) : auditd                     start, ver=2.4.5 format=raw kernel=2.6.32-696.el6.x86_64 auid=unset pid=1319 subj=system_u:system_r:auditd_t:s0 res=success ----type=CONFIG_CHANGE msg=audit(05/22/2017 11:14:10.519:5) : audit_backlog_limit=320 old=64 auid=unset ses=unset subj=system_u:system_r:auditctl_t:s0 res=yes ----type=USER_ACCT msg=audit(05/22/2017 11:20:01.108:6) : user pid=2073 uid=root auid=unset ses=unset subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct=root exe=/usr/sbin/crond hostname=? addr=? terminal=cron res=success' ----type=CRED_ACQ msg=audit(05/22/2017 11:20:01.108:7) : user pid=2073 uid=root auid=unset ses=unset subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct=root exe=/usr/sbin/crond hostname=? addr=? terminal=cron res=success' ----type=LOGIN msg=audit(05/22/2017 11:20:01.119:8) : pid=2073 uid=root subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=unset new auid=root old ses=unset new ses=1 ----
cronjob not redirecting output of command when used with option
cron;linux audit
The command does not produce output, but runs ok.You can see this because the file rummy got created.The ausearch utility seems to expect a search criteria, and the empty output could be due to you not providing one.See the ausearch manual on your system for further information.After a bit of reading of the ausearch manual, I found the following:--input-logs  Use the log file location from auditd.conf as input for searching. This is needed if you are using ausearch from a cron job.Doing some Googling confirms that this indeed may be the issue. One email describes the problem:You need to use the --input-logs option. If ausearch sees stdin as a pipe, it   assumes that is where it gets its data from. The input logs option tells it   to ignore the fact that stdin is a pipe and process the logs. Aureport has   the same problem and option to fix it.This was fixed in the 1.6.7 general release and backported to the 1.6.5 RHEL5   release.There also seems to be users who does not solve this by using --input-logs, but it's not clear what else may be wrong as there are never any followups from them.