Re: Central Audit Server with Prelude and Prewikka - RHEL5
On Friday 13 February 2009 03:11:26 pm Dan Gruhn wrote:
I'm using Prelude and Prewikka to view events and I see the
master as a
sensor/source and its events, but I don't see the node. I thought that
once the audit/syslog information was making it to the central files the
rest would also work but that doesn't seem to be the case.
Prelude has its own messaging protocol. It picks things out of its
configuration files to fill in various fields in its data packets. So, if you
have the audit-prelude sensor reading aggregated logs, it won't know these
are coming from all over the place.
To use prelude the way it wants to be setup, you would have the audisp-prelude
sensor on each machine sending to a central prelude-manager. Let audit send
its data to its aggregator and prelude send its own data to its aggregator.
Yes, there will be duplication...but it will work better.
-Steve