I configured auditd in two RHEL servers with required rules. The audit logs are as expected. I want to forward these logs to a central server so that the analysis will be easy. I tried the two approaches mentioned in this link Send auditd logs to a remote log server in Red Hat Enterprise
Issue with approach 1 (Send to a remote auditd server): The logs from all clients are appended to a single file. I am not able to get separate reports for each client.
Issue with approach 2 (Send to a remote syslog server): The logs in the server side has extra words at the start of the line. These are added to the actual auditd log from the client
"Jan 12 16:38:22 MahineName audispd: node= MahineName “type=USER_TTY msg=audit(1484257088.191:1486822)
Due to this, aureport is not able to parse these logs and show zero events.
Please suggest a proper approach to collect all audit logs separately from all clients and run aureport on these
OS : RHEL 6