Yes please, 2 questions :
1) Is there a way to run aureport on updating auditd logs ? That is, not running aureport on all logs, just updating the last aureport with the recent addition of logs ? 2) Could aureport run on combined auditd logs from more than one computor and produce multiple outputs ? Thank you
To answer the above
For 1. use the -checkpoint option of ausearch to generate the events.
For 2. assuming you disseminate the source hosts on the aggregating host, again multiple invocations of ausearch will work with the -checkpoint option.
Rgds