Script that calls ausearch behaves differently when piped data on stdin

Question

Can someone explain why passing a bash script data via STDIN would cause the command within the script to NOT function?

Script:

#!/bin/bash
ausearch          


        

Answer 1

ausearch changes its behavior if stdin is a pipe. If it is it searches through stdin rather than through the audit daemon logs. You can use --input-logs to force it to read from the logs.

echo "blah" | ausearch -i -a 1221217 --input-logs

Redirecting stdin would achieve the same end.

#!/bin/bash
ausearch -i -a 1221217 < /dev/null