Re: [PATCH] Add auditd listener and remote audit protocol

[LC Bruzenak <lenny@magitekltd.com>]

On Thu, 2008-08-14 at 19:37 -0400, John Dennis wrote:   
> This is why the IPA project has selected AMQP (www.amqp.org) as the 
> transport for centralized loggiing (included audit logs). AMQP will 
> queue in persistent storage messages which do not reach their 
> destination until delivery is assured. The thinking was AMQP was too 
> heavy weight a dependency for a simple centralized audit log but makes 
> sense in an enterprise deployment such as IPA.
> 

I see; thanks for the info John.
Steve did mention this previously to me but I didn't get all the
implications I guess (dense!). 

I do require centralized auditing and I also require (more importantly)
not losing any.

I cannot speak for other end-users...but my guess is that if they are
using audit and aggregating they probably care about not dropping it,
whereas others can just syslog the events if the auditd isn't enabled
and then use centralized syslog, right?

AMQP may be heavyweight, however if you start down the road of trying to
not lose networked audit data you probably end up somewhere near there
anyway...

Thx,
LCB.

-- 
LC (Lenny) Bruzenak
lenny@magitekltd.com