7:47 a.m.
I'm currently dealing with a VMware appliance, and need to export my audit logs.
Despite VMware telling me to use the audisp-remote plugin with auditd, I get a dependency
check for OpenLDAP, and the install fails.
I'm pointing to my audit server (a Splunk box) via IP address. Is there any
workaround, or am I stuck adding even MORE software to the appliance ??
______________________________________________________________________________________
It is by Caffeine alone, that I set my Mind in Motion.
It is by the Beans of Java that thought acquires speed, the hands develop shakes, the
shakes become a warning.
It is by Caffeine alone that I set my Mind in Motion.
______________________________________________________________________________________
11 a.m.
On Mon, 9 Feb 2015 13:47:36 +0000 (UTC)
salgak(a)comcast.net wrote:
I'm currently dealing with a VMware appliance, and need to export
my
audit logs. Despite VMware telling me to use the audisp-remote plugin
with auditd, I get a dependency check for OpenLDAP, and the install
fails.
I'm pointing to my audit server (a Splunk box) via IP address. Is
there any workaround, or am I stuck adding even MORE software to the
appliance ??
The package the plugin is included in contains all of them. The
zos-remote plugin is the one that wants openldap.
-Steve
11:26 a.m.
Yeah, just crawled into the rpm and saw that. Going to try to re-spin a smaller RPM
without the zos and see if that works.
----- Original Message -----
From: "Steve Grubb" <sgrubb(a)redhat.com>
To: salgak(a)comcast.net
Cc: linux-audit(a)redhat.com
Sent: Monday, February 9, 2015 12:00:58 PM
Subject: Re: Audit: audisp-remote plugin: why is OpenLDAP a dependency ??
On Mon, 9 Feb 2015 13:47:36 +0000 (UTC)
salgak(a)comcast.net wrote:
I'm currently dealing with a VMware appliance, and need to export
my
audit logs. Despite VMware telling me to use the audisp-remote plugin
with auditd, I get a dependency check for OpenLDAP, and the install
fails.
I'm pointing to my audit server (a Splunk box) via IP address. Is
there any workaround, or am I stuck adding even MORE software to the
appliance ??
The package the plugin is included in contains all of them. The
zos-remote plugin is the one that wants openldap.
-Steve
1:01 p.m.
So, respin a new RPM using rpmrebuild, dropping the zos plugins ?
i.e. the appropriate section of the SPEC would now look like this:
Provides: audit-audispd-plugins = 1.8-0.28.1
#Requires: openldap2
#Requires: rpmlib(PayloadFilesHavePrefix) <= 4.0-1
#Requires: rpmlib(CompressedFileNames) <= 3.0.4-1
Requires: libaudit.so.0()(64bit)
Requires: libauparse.so.0()(64bit)
Requires: libc.so.6()(64bit)
Requires: libc.so.6(GLIBC_2.2.5)(64bit)
Requires: libc.so.6(GLIBC_2.3)(64bit)
Requires: libc.so.6(GLIBC_2.3.4)(64bit)
Requires: libc.so.6(GLIBC_2.4)(64bit)
Requires: libc.so.6(GLIBC_2.8)(64bit)
#Requires: liblber-2.4.so.2()(64bit)
#Requires: libldap-2.4.so.2()(64bit)
Requires: libpthread.so.0()(64bit)
Requires: libpthread.so.0(GLIBC_2.2.5)(64bit)
Requires: libpthread.so.0(GLIBC_2.3.2)(64bit)
#Requires: rpmlib(PayloadIsLzma) <= 4.4.6-1
#suggest
#enhance
%description
The audit-audispd-plugins package contains plugin components for the
audit dispatcher (audispd).
Authors:
--------
Steve Grubb <sgrubb(a)redhat.com>
%files
%config(noreplace) %attr(0640, root, root) "/etc/audisp/audisp-remote.conf"
%config(noreplace) %attr(0640, root, root)
"/etc/audisp/plugins.d/au-remote.conf"
#%config(noreplace) %attr(0640, root, root)
"/etc/audisp/plugins.d/audispd-zos-remote.conf"
#%config(noreplace) %attr(0640, root, root) "/etc/audisp/zos-remote.conf"
%attr(0750, root, root) "/usr/sbin/audisp-remote"
#%attr(0750, root, root) "/usr/sbin/audispd-zos-remote"
%doc %attr(0644, root, root) "/usr/share/man/man5/audisp-remote.conf.5.gz"
#%doc %attr(0644, root, root) "/usr/share/man/man5/zos-remote.conf.5.gz"
%doc %attr(0644, root, root) "/usr/share/man/man8/audisp-remote.8.gz"
#%doc %attr(0644, root, root) "/usr/share/man/man8/audispd-zos-remote.8.gz"
----- Original Message -----
From: salgak(a)comcast.net
To: "Steve Grubb" <sgrubb(a)redhat.com>
Cc: linux-audit(a)redhat.com
Sent: Monday, February 9, 2015 12:26:15 PM
Subject: Re: Audit: audisp-remote plugin: why is OpenLDAP a dependency ??
Yeah, just crawled into the rpm and saw that. Going to try to re-spin a smaller RPM
without the zos and see if that works.
----- Original Message -----
From: "Steve Grubb" <sgrubb(a)redhat.com>
To: salgak(a)comcast.net
Cc: linux-audit(a)redhat.com
Sent: Monday, February 9, 2015 12:00:58 PM
Subject: Re: Audit: audisp-remote plugin: why is OpenLDAP a dependency ??
On Mon, 9 Feb 2015 13:47:36 +0000 (UTC)
salgak(a)comcast.net wrote:
I'm currently dealing with a VMware appliance, and need to export
my
audit logs. Despite VMware telling me to use the audisp-remote plugin
with auditd, I get a dependency check for OpenLDAP, and the install
fails.
I'm pointing to my audit server (a Splunk box) via IP address. Is
there any workaround, or am I stuck adding even MORE software to the
appliance ??
The package the plugin is included in contains all of them. The
zos-remote plugin is the one that wants openldap.
-Steve
4:22 p.m.
Actually, I was trying to do the re-spin, but it's been overcome by events,
just shipping the output of auditd to /var/log/messages, and letting Splunk
sort it all out. . .
-----Original Message-----
From: Steve Grubb [mailto:sgrubb@redhat.com]
Sent: Thursday, February 12, 2015 2:42 PM
To: salgak(a)comcast.net
Cc: linux-audit(a)redhat.com
Subject: Re: Audit: audisp-remote plugin: why is OpenLDAP a dependency ??
On Tuesday, February 10, 2015 07:01:27 PM salgak(a)comcast.net wrote:
So, respin a new RPM using rpmrebuild, dropping the zos plugins ?
i.e. the appropriate section of the SPEC would now look like this:
I'll see about making a configure switch to not build it, too.
-Steve
-----
No virus found in this message.
Checked by AVG - www.avg.com
Version: 2013.0.3495 / Virus Database: 4257/9101 - Release Date: 02/12/15
3606
days inactive
3609
days old
linux-audit@lists.linux-audit.osci.io
5 comments
3 participants
participants (3)
-
Keith A. Glass -
salgak＠comcast.net
-
Steve Grubb