Re: ausearch on the fly
Phillipe,
To close this off, yes, you will need to investigate making use of the --input
option. You
may also want to consider having a central syslog directory structure that allows
you to simulate the local directory structure (/var/log/audit)
by having a revolving set of audit.log, audit.log.1, etc files and age them off to
your raw archive once you have processed them.
My preference is to enrich the logs via ausearch on the local host as this mitigates
a number of risks (lost logs as per this discussion, local uids)
and then send the results to a central log management capability.
Regards
Burn
On Fri, 2020-02-07 at 12:44 +0000, MAUPERTUIS, PHILIPPE wrote:
Hi,
I should have been more precise in my question.
I want to run this ausearch on the central log server, not on the original
server.
Very likely i need to specify the input file in that.
And this input file would need to be rotated outside auditd
Philippe
Envoyé depuis mon mobile Orange
Snip
Attachments:
- attachment.html (text/html — 1.7 KB)