The actual problem is that a looping ausearch with checkpoints will _miss_ some audit events. It looks like when it happens it has also decided to err 12 and restarting as suggested in the man page with --start checkpoint is not enough to catch them.
RHEL8 fwiw
Troed Sångberg
npub192…vy8wk
2026-04-13 14:19:55 UTC
in reply to nevent1q…qc49
Author Public Key
npub192kepsf3ypyzgsds9r93amadzta0efs05ftuxhl84m04e9xxhy9qevy8wkSeen on
wss://relay.momostr.pinkPublished at
2026-04-13 14:19:55 UTCEvent JSON
{
"id": "0febc03b914f8bdeb352030b993698fc53d3306ae017f1e2e484860fe8d6501c",
"pubkey": "2aad90c13120482441b028cb1eefad12fafca60fa257c35fe7aedf5c94c6b90a",
"created_at": 1776089995,
"kind": 1,
"tags": [
[
"p",
"2aad90c13120482441b028cb1eefad12fafca60fa257c35fe7aedf5c94c6b90a"
],
[
"e",
"b866034a8288341e5966cbd8a844a93e09216bfb945046778eabeee6f4bc8dc4",
"",
"root",
"2aad90c13120482441b028cb1eefad12fafca60fa257c35fe7aedf5c94c6b90a"
],
[
"proxy",
"https://swecyb.com/@troed/116397833945282061",
"web"
],
[
"proxy",
"https://swecyb.com/users/troed/statuses/116397833945282061",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://swecyb.com/users/troed/statuses/116397833945282061",
"pink.momostr"
],
[
"-"
]
],
"content": "The actual problem is that a looping ausearch with checkpoints will _miss_ some audit events. It looks like when it happens it has also decided to err 12 and restarting as suggested in the man page with --start checkpoint is not enough to catch them.\n\nRHEL8 fwiw",
"sig": "97df857149c136cf78c7ef3767a45e3f4a1816b14d4c05184bef6d856c6ec025cf5c4f8014e625aaa8d64e6827497bd38c766b8f678c3e6c9475fb9aa28a88e5"
}