10:53 a.m.
On Wed, 2008-12-03 at 17:28 +0200, Loredan Stancu wrote:
>
> I know how to activate the audisp-plugin, what I asked is how can I use
> it.
>
> What I need is an example of an application which can stay on the remote
> host, listen for incoming events send by audisp-remote plugin and store
> these events in a regular file.
OK.
That's what the auditd does if the remote host is also SElinux.
So - next questions:
* Is the remote host not a SElinux machine? You'd need to emulate the
protocol on the receive side.
* If it is a SElinux machine (F9/F10/other?), do you want the
originating events in a different place than the default? Like separated
by sending host instead of lumped together with the other audit?
If the latter is the case, there are ways of doing this now depending on
your intent.
Supposing the remote system is an SElinux machine (a machine which stores
all the user activity send by audisp-remote plugins. There are more then
one machine for which I want to store events) what should I do on this
machine to keep separate file events for each machine
Also this is an area Steve has discussed may be open for
modification.
The auditd on the aggregating side may be able to separate data based on
other criteria per user feedback.
LCB.
--
LC (Lenny) Bruzenak
lenny(a)magitekltd.com
--
Linux-audit mailing list
Linux-audit(a)redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
11:02 a.m.
New subject: audisp-prelude problems
On Wednesday 03 December 2008 11:53:19 Loredan Stancu wrote:
Supposing the remote system is an SElinux machine (a machine which
stores
all the user activity send by audisp-remote plugins. There are more then
one machine for which I want to store events) what should I do on this
machine to keep separate file events for each machine
The current design of the audit system is to aggregate all logs in a unifield
format. Ausearch and report are node aware and can separate records based on
the originating node.
ausearch --start today --node 192.168.1.1
This of course assumes that you took the step of selecting a node name in
/etc/audisp/audispd.conf. :)
-Steve
11:17 a.m.
New subject: audisp-prelude problems
On Wed, 2008-12-03 at 18:53 +0200, Loredan Stancu wrote:
> On Wed, 2008-12-03 at 17:28 +0200, Loredan Stancu wrote:
>
...
Supposing the remote system is an SElinux machine (a machine which
stores
all the user activity send by audisp-remote plugins. There are more then
one machine for which I want to store events) what should I do on this
machine to keep separate file events for each machine
A couple of different ways to do this:
1: Leave the events in the original log but create new duplicates
- periodically parse using ausearch and filter the output on "node" to
different file (now)
- use the auparse library on logfiles - see audit-1.7.9/auparse/test/
for examples (custom)
- also possibly use the af_unix plugin as per setroubleshoot for event
access (custom)
- write a patch for a new audisp plugin (custom)
2: MY favorite: ask Steve how to make the aggregating side flexible in
this regard. We may need a BZ filed or a consensus about what is
important on this list. I also would like a separation based on time to
allow for an easier archive/restore capability...and maybe that built in
if possible!
:)
Separation based on node is also a potential "good thing".
Anyway, the point is if there was a official audit modification to
enable this, the data would not be duplicated as it would above.
LCB.
--
LC (Lenny) Bruzenak
lenny(a)magitekltd.com
11:34 a.m.
New subject: audisp-prelude problems
On Wednesday 03 December 2008 12:17:46 LC Bruzenak wrote:
MY favorite: ask Steve how to make the aggregating side flexible in
this regard.
Why did I know this was coming? :)
We may need a BZ filed or a consensus about what is important on this
list. I
also would like a separation based on time to allow for an easier
archive/restore capability
There is a cron script shipped but not installed that can do the right thing.
...and maybe that built in if possible! Separation based on node is
also a
potential "good thing".
The main poblem is that once its separated, ausearch/report don't know how to
put it back together again. The current algorithm is a simple number index and
ausearch, aureport, and even auparse knows how to find the files in the right
order to make sense of it.
-Steve
6001
days inactive
6001
days old
linux-audit@lists.linux-audit.osci.io
3 comments
3 participants
participants (3)
-
LC Bruzenak -
Loredan Stancu -
Steve Grubb