Re: no node= in ausearch
On Friday 12 September 2008 21:40:23 LC Bruzenak wrote:
> Locally generated events won't have the node= (at least, on
my machine
> they don't). Remotely generated events should have the node= on them.
I thought there was a distinction as to where it was assigned, as in
auditd.conf vice audispd.conf.
Yes. For remote logging the one in audispd.conf is used. I'll be unifying
things sometime in the next few months.
-Steve