0

I configured auditd in two RHEL servers with required rules. The audit logs are as expected. I want to forward these logs to a central server so that the analysis will be easy. I tried the two approaches mentioned in this link Send auditd logs to a remote log server in Red Hat Enterprise

Issue with approach 1 (Send to a remote auditd server): The logs from all clients are appended to a single file. I am not able to get separate reports for each client.

Issue with approach 2 (Send to a remote syslog server): The logs in the server side has extra words at the start of the line. These are added to the actual auditd log from the client

"Jan 12 16:38:22 MahineName audispd: node= MahineName “type=USER_TTY msg=audit(1484257088.191:1486822)

Due to this, aureport is not able to parse these logs and show zero events.

Please suggest a proper approach to collect all audit logs separately from all clients and run aureport on these

OS : RHEL 6

0

There is an option to filter aureport by 'node'. This should work for me

aureport

--node node-name
Only select events originating from node name string for processing in the reports. The default is to include all nodes. Multiple nodes are allowed. 

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.