Filter for audit.log

Filter for audit.log

[corbin]

Hello, we have installed Splunk in order to monitor the audit.log files of
several systems.  However, our audit.log files are turning over quicker
than usual since Splunk seems to span our audit.log file with entries.

Is there a way to get audit.log to filter messages from Splunk in RHEL 5
server systems?

Thanks in advance!
Starr

Re: Filter for audit.log

[Steve Grubb]

On Monday 21 December 2009 10:46:51 am corbin@arlut.utexas.edu wrote:
> Is there a way to get audit.log to filter messages from Splunk in RHEL 5
> server systems?

I really don't know what splunk is doing or why. Does it run with its own UID 
or does it run as root? If it does have its own uid, then that might be used 
for filtering. Aside from that, since its a commercial app, you might ask them 
if they've tested it on a linux system with nispom audit rules and what they 
would suggest.

-Steve