Auditd 1.0.15 in RHEL4 U4

[Matthew Booth <mbooth@redhat.com>]

I have a requirement to stream audit logs from RHEL 4. The product will
have to be deployed before RHEL 4.5 is likely to be released, so I
expect I will have to import the 4.5 rpm into U4. Will this work without
any other 4.5 updates?

Also, I had a quick flick through the dispatcher example. I note that
it's shipping binary logs. This is great from a storage POV, however it
wasn't clear to me how this would tie in with the existing audit tools.
If I simply dump the binary data to a file, can I easily:

* Turn it into text?
* Process it with aureport/ausearch?

Also, that you're aware of, has anybody already implemented the simplest
possible centralised log server. ie:

* Stream uncompressed, unencrypted, unauthenticated audit logs to server
* Write 1 log file per client audit daemon
* Rotate on signal, respecting message boundaries

I'll be writing this if not.

Thanks,

Matt
-- 
Red Hat, Global Professional Services

M:       +44 (0)7977 267231
GPG ID:  D33C3490
GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490