Hi,
I'm testing version 1.7.9 of audit using audisp-prelude plugin and I have
some problems:
1. audisp-prelude plugin is not generating events when a user is logged in.
2. audisp-prelude plugin is not sending uid, gid to a prelude-manager
3. No events are generate for watched files/exec/mk_exe if no tow -k
options are specified in the rule. One of the -k options should contain
'-k ids-type-severity' and another -k may contain anything. If you specify
only one -k options no events are generated.
Another question is how I can use audisp-remote to send events somewhere
remote?
Thx,
Loredan Stancu