Forward Auditd logs to one servers and analyze using aureport

Question

I configured auditd in two RHEL servers with required rules. The audit logs are as expected. I want to forward these logs to a central server so that the analysis will be easy. I tried the two approaches mentioned in this link Send auditd logs to a remote log server in Red Hat Enterprise

Issue with approach 1 (Send to a remote auditd server): The logs from all clients are appended to a single file. I am not able to get separate reports for each client.

Issue with approach 2 (Send to a remote syslog server): The logs in the server side has extra words at the start of the line. These are added to the actual auditd log from the client

"Jan 12 16:38:22 MahineName audispd: node= MahineName “type=USER_TTY msg=audit(1484257088.191:1486822)

Due to this, aureport is not able to parse these logs and show zero events.

Please suggest a proper approach to collect all audit logs separately from all clients and run aureport on these

OS : RHEL 6

Answer 1

There is an option to filter aureport by 'node'. This should work for me

aureport

--node node-name
Only select events originating from node name string for processing in the reports. The default is to include all nodes. Multiple nodes are allowed.