Announcing austream

austream is a utility to stream audit logs to a remote hosts via syslog. Its features are: * Works on both auditd and laus (on laus it's a dispatcher) * Messages sent immediately off-node * Sends syslog packets directly, without going through syslogd * Very low overhead, even at extreme volume (8,000 events/sec) Tested platforms are RHEL 4 U4+ and RHEL 3 U8+. There are a few caveats, though. Foremost is the fact that it's not a dispatcher: it replaces auditd. This is because, to date, development has been tightly focused on a single set of requirements. It's still under development. Some bigger items on my todo list are: * Message inspection to turn PATH records into absolute paths * Limited output buffering * Option to run as a dispatcher * Host it somewhere The git repository is available at git://heisenbug.com/austream.git. Please have a look. Patches welcome. To build: ./configure TARGET=(laus|auditd) make or make rpm If you build the auditd rpm, when it installs it will add itself to /etc/inittab. Make sure you configure the destination in /etc/sysconfig/austream before doing 'telinit q'. Matt -- Matthew Booth, RHCA, RHCSS Red Hat, Global Professional Services M: +44 (0)7977 267231 GPG ID: D33C3490 GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490