Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

On a Linux (debian) box, I have a NFS server wich seems to be overloaded by requests. In order to identify the problem, I'm trying to monitor with auditd/auditctl accessed files in the partition exported by the NFS server.

The problem is that our disk or nfs problem prevents auditd to write logs on /var/log/auditd/auditd.log.

What I really need is to send all logs somewhere else than on a local file.

Can I simply redirect all logs from 192.168.1.1 to 192.168.1.2 (the network is working correctly) ?

share|improve this question
add comment

2 Answers

I'm assuming you're on Linux by how you phrased your question. Should that be the case, then yes there is, look into audisp-remote and audispd. These are standard components in the current audit tools on Linux.

share|improve this answer
    
I'm using linux, right (just edited my question). I have just found those two tools. Could not find any documentation except man pages yet... –  ascobol Feb 13 '12 at 17:22
add comment

You can set the auditd log file in /etc/auditd.conf. You can't make auditd itself send logs over the network, but you can direct it to a file that's on some other remote filesystem such as sshfs.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.