Re: Centralized Logging question #2
On Thursday, April 28, 2016 07:55:13 PM Warron S French wrote:
If I centralize audit logging through rsyslog, and I have each of the
remote
machines' /etc/rsyslog.conf to use the same generic audit.log file name
instead of customizing the audit logs with something like;
HOSTNAME-audit.log, because ausearch apparently only looks for a file
specifically of the format audit.log...
People who use rsyslog as the centralizing tool are likely to be using
something else like splunk or other tools to do audit reporting and review.
Will the log-data submitted from the various hosts be consolidated
into a
single file?
Through the native audit tools, yes. Through other tools...I don't know. There
are a variety of ways central logging can be done. I'm surprised no one has
chimed in to offer an alternate.
Will the ausearch command then be usable with the -if argument?
Once rsyslog gets the audit event, it adds its own data to the record. That
messes up the audit tool's parsers.
-Steve