3

On a Linux (debian) box, I have a NFS server wich seems to be overloaded by requests. In order to identify the problem, I'm trying to monitor with auditd/auditctl accessed files in the partition exported by the NFS server.

The problem is that our disk or nfs problem prevents auditd to write logs on /var/log/auditd/auditd.log.

What I really need is to send all logs somewhere else than on a local file.

Can I simply redirect all logs from 192.168.1.1 to 192.168.1.2 (the network is working correctly) ?

Improve this question
1
  • Surely, if you use rsyslog as a transport
    – Vitaly Isaev
    Commented Aug 28, 2014 at 12:15

2 Answers 2

Reset to default
4

I'm assuming you're on Linux by how you phrased your question. Should that be the case, then yes there is, look into audisp-remote and audispd. These are standard components in the current audit tools on Linux.

Improve this answer
1
  • I'm using linux, right (just edited my question). I have just found those two tools. Could not find any documentation except man pages yet...
    – ascobol
    Commented Feb 13, 2012 at 17:22
1

You can set the auditd log file in /etc/auditd.conf. You can't make auditd itself send logs over the network, but you can direct it to a file that's on some other remote filesystem such as sshfs.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .