Re: Central Audit Server with Prelude and Prewikka - RHEL5
Steve,
Thanks for the advice. I was wondering about duplicating those
information streams and needed the encouragement to go ahead.
One thing that did come up, I changed a lot of "localhost" references in
the "Audit + Prelude HOWTO" and in the /etc/prelude/default/client.conf
files to my actual server name (master) and I also changed a line in
/etc/prelude-manager/prelude-manager.conf from
listen = 127.0.0.1
to
listen = master
All of these changes required me to revoke my old prelude-manager
registrations under "localhost" and re-register all of the sensors to
"master". Perhaps I didn't need all of this but it is all working now
(except for my 5.2 SELinux problem).
I'm running prelude-lml on the master and I'll be figuring out if I
should run it on each node or it will pick up everything from the
master's /var/log/messages file. I'm thinking it would be better to
keep things separate but I'll be testing.
If anyone can tell me if some of those "localhost" changes were not
necessary it would be helpful to know for future reference. I could
update the "Audit + Prelude HOWTO" with what I've found and send it to
back to Steve if that would be useful.
Dan
Steve Grubb wrote:
On Friday 13 February 2009 03:11:26 pm Dan Gruhn wrote:
> I'm using Prelude and Prewikka to view events and I see the master as a
> sensor/source and its events, but I don't see the node. I thought that
> once the audit/syslog information was making it to the central files the
> rest would also work but that doesn't seem to be the case.
>
Prelude has its own messaging protocol. It picks things out of its
configuration files to fill in various fields in its data packets. So, if you
have the audit-prelude sensor reading aggregated logs, it won't know these
are coming from all over the place.
To use prelude the way it wants to be setup, you would have the audisp-prelude
sensor on each machine sending to a central prelude-manager. Let audit send
its data to its aggregator and prelude send its own data to its aggregator.
Yes, there will be duplication...but it will work better.
-Steve
--
Linux-audit mailing list
Linux-audit(a)redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
--
Dan Gruhn
Group W Inc.
8315 Lee Hwy, Suite 303
Fairfax, VA, 22031
PH: (703) 752-5831
FX: (703) 752-5851