0

rsyslog documentation is very unclear. I want to forward only errors from auditlog to the remote rsyslog server. The examples show:

# auditd audit.log  
$InputFileName /var/log/audit/audit.log  
$InputFileTag tag_audit_log:  
$InputFileStateFile audit_log  
$InputFileSeverity info  
$InputFileFacility local6  
$InputRunFileMonitor

With "InputFileSeverity" set to info, does that mean ALL entries into audit log will show up as info including errors? Or if I set it to "error" does that mean all entries including info will show up as error level?

I only want to see errors forwarded. I feel I am really missing the underlying mechanics on how to set this simple configuration up.

1

Assuming you are using the text file input module for rsyslog, the InputFileSeverity parameter defines the severity stored in rsyslog, NOT the severity of the messages captured in the audit.log file. The file input module does not filter for you. You should configured auditd to only capture "error" level severity in the audit.log file, then set the inputfileseverity to error, and errors from audit.log will be captured by rsyslog at error level severity.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.