Re: audisp-prelude problems
On Wed, 2008-12-03 at 18:53 +0200, Loredan Stancu wrote:
> On Wed, 2008-12-03 at 17:28 +0200, Loredan Stancu wrote:
>
...
Supposing the remote system is an SElinux machine (a machine which
stores
all the user activity send by audisp-remote plugins. There are more then
one machine for which I want to store events) what should I do on this
machine to keep separate file events for each machine
A couple of different ways to do this:
1: Leave the events in the original log but create new duplicates
- periodically parse using ausearch and filter the output on "node" to
different file (now)
- use the auparse library on logfiles - see audit-1.7.9/auparse/test/
for examples (custom)
- also possibly use the af_unix plugin as per setroubleshoot for event
access (custom)
- write a patch for a new audisp plugin (custom)
2: MY favorite: ask Steve how to make the aggregating side flexible in
this regard. We may need a BZ filed or a consensus about what is
important on this list. I also would like a separation based on time to
allow for an easier archive/restore capability...and maybe that built in
if possible!
:)
Separation based on node is also a potential "good thing".
Anyway, the point is if there was a official audit modification to
enable this, the data would not be duplicated as it would above.
LCB.
--
LC (Lenny) Bruzenak
lenny(a)magitekltd.com