Re: [PATCH] Add auditd listener and remote audit protocol
On Thu, 2008-08-14 at 19:37 -0400, John Dennis wrote:
This is why the IPA project has selected AMQP (www.amqp.org) as the
transport for centralized loggiing (included audit logs). AMQP will
queue in persistent storage messages which do not reach their
destination until delivery is assured. The thinking was AMQP was too
heavy weight a dependency for a simple centralized audit log but makes
sense in an enterprise deployment such as IPA.
I see; thanks for the info John.
Steve did mention this previously to me but I didn't get all the
implications I guess (dense!).
I do require centralized auditing and I also require (more importantly)
not losing any.
I cannot speak for other end-users...but my guess is that if they are
using audit and aggregating they probably care about not dropping it,
whereas others can just syslog the events if the auditd isn't enabled
and then use centralized syslog, right?
AMQP may be heavyweight, however if you start down the road of trying to
not lose networked audit data you probably end up somewhere near there
anyway...
Thx,
LCB.
--
LC (Lenny) Bruzenak
lenny(a)magitekltd.com