Re: Running multiple audit service clients
On Thursday, February 11, 2016 03:19:27 PM Max Timchenko wrote:
I have read the docs on audispd(8) - is it something auditd and the
other
client could use to enable multiple access? It sounds like audispd does
support multiple clients, but I would guess all clients would have to use
the audispd plugin interface instead of the usual kernel API.
Yes. This is intentional and has existed for about 10 years.
What is missing from the documentation for me is the relationship
between
audispd and auditd - whether audispd is an optional component of auditd that
can run concurrently
Yes. If you look in auditd.conf, you will see that there is a configuration
option, dispatcher, which allows you to select another consumer of audit
events. Normally the selection of /sbin/audispd is the best because it allows
"unlimited" multiplexing of the audit stream.
You can send events to syslog, setroubleshoot, and remotely log events in an
aggregator all at the same time.
, or audispd is a replacement of auditd when configured
(and then auditd cannot run on the same machine
without running into the same multi-client issues).
No. The audispd man page says, "audispd is an audit event multiplexor. It has
to be started by the audit daemon in order to get events."
HTH...
-Steve