audisp-remote and audisp-prelude question

I thought that we have : (from another machine) audisp-remote | v (to collector) kernel->auditd->audispd->audisp-prelude and that I could pick off the prelude-bound events on the aggregated data, but I don't get the events into the prelude DB. For example, I see the client logins in the collector's log, so the aggregation appears to be working. Local logins on the collector machine do get sent to prelude, so the audisp-prelude plugin is working. However, logins on the remote machine which are sent to the collector log do not make it into the prelude DB (at least prewikka doesn't show them). I have no prewikka filters and I have the prewikka viewer set to "1 day". Any ideas? Using 1.7.12 audit rpms. Here is a sample of "ausearch -ts today -i -m USER_LOGIN" on the collector: ... node=v157 type=USER_LOGIN msg=audit(03/24/2009 10:44:27.533:548759) : user pid=11353 uid=root auid=root ses=328 subj=system_u:system_r:sshd_t:s0-s15:c0.c1023 msg='uid=root exe=/usr/sbin/sshd (hostname=homeserver, addr=192.168.31.40, terminal=/dev/pts/0 res=success)' ---- node=audit type=USER_LOGIN msg=audit(03/24/2009 11:11:37.882:1412) : user pid=3103 uid=root auid=root ses=54 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='uid=root exe=/usr/sbin/sshd (hostname=192.168.31.40, addr=192.168.31.40, terminal=/dev/pts/3 res=success)' On the prewikka screen I only see the second event. Thx, LCB. -- LC (Lenny) Bruzenak lenny(a)magitekltd.com