From mboxrd@z Thu Jan 1 00:00:00 1970 From: Matthew Booth Subject: Auditd 1.0.15 in RHEL4 U4 Date: Mon, 12 Feb 2007 13:54:20 +0000 Message-ID: <1171288460.4760.10.camel@localhost.localdomain> Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Return-path: Received: from [10.235.124.141] (sebastian-int.corp.redhat.com [172.16.52.221]) by pobox.surrey.redhat.com (8.12.11.20060308/8.12.11) with ESMTP id l1CJn8b3024394 for ; Mon, 12 Feb 2007 19:49:12 GMT List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com I have a requirement to stream audit logs from RHEL 4. The product will have to be deployed before RHEL 4.5 is likely to be released, so I expect I will have to import the 4.5 rpm into U4. Will this work without any other 4.5 updates? Also, I had a quick flick through the dispatcher example. I note that it's shipping binary logs. This is great from a storage POV, however it wasn't clear to me how this would tie in with the existing audit tools. If I simply dump the binary data to a file, can I easily: * Turn it into text? * Process it with aureport/ausearch? Also, that you're aware of, has anybody already implemented the simplest possible centralised log server. ie: * Stream uncompressed, unencrypted, unauthenticated audit logs to server * Write 1 log file per client audit daemon * Rotate on signal, respecting message boundaries I'll be writing this if not. Thanks, Matt -- Red Hat, Global Professional Services M: +44 (0)7977 267231 GPG ID: D33C3490 GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490