How to recover when "ausearch" fails with "Corrupted checkpoint file"

Solution Verified - Updated -

Issue

  • When using the --checkpoint parameter with ausearch, ausearch fails with the following error

    Corrupted checkpoint file. Inode match, but newer complete event (<timestamp1>:<line1>) found before loaded checkpoint <timestamp2>:<line2>

Environment

  • Red Hat Enterprise Linux (RHEL)
  • ausearch

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content