sub query {
my ( $from_t, $callback ) = @_;
my $q;
- $q = { 'package.time' => { '$lt' => $from_t * 1 } } if $from_t;
+ $q->{'package.time'} = { '$lt' => $from_t * 1 } if $from_t;
+# $q->{'package.name'} = { '$ne' => 'syslogd' };
+ $q->{'tag'} = { '$ne' => 'CRON' };
warn "# query ", dump($q);
$audit->ensure_index({ 'package.name' => 1 });
my $cursor = $audit->query($q)->sort({ 'package.time' => -1 })->limit( 100 );