I have a requirement to stream audit logs from RHEL 4. The product will
have to be deployed before RHEL 4.5 is likely to be released, so I
expect I will have to import the 4.5 rpm into U4. Will this work without
any other 4.5 updates?
Also, I had a quick flick through the dispatcher example. I note that
it's shipping binary logs. This is great from a storage POV, however it
wasn't clear to me how this would tie in with the existing audit tools.
If I simply dump the binary data to a file, can I easily:
* Turn it into text?
* Process it with aureport/ausearch?
Also, that you're aware of, has anybody already implemented the simplest
possible centralised log server. ie:
* Stream uncompressed, unencrypted, unauthenticated audit logs to server
* Write 1 log file per client audit daemon
* Rotate on signal, respecting message boundaries
I'll be writing this if not.
Thanks,
Matt
--
Red Hat, Global Professional Services
M: +44 (0)7977 267231
GPG ID: D33C3490
GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490