audit collection

[LC Bruzenak <lenny@magitekltd.com>]

On my F9 machines I still get no events (that I can tell) across.

I have changed to sending from / receiving on 64-bit machines only,
since that's what I have for now.

I have made the "name_format = user", "name = hugo" on the sender in
audispd.conf just to be certain it is unique.

===================
On the sender I see:

messages log (hundreds of these):
Sep 15 11:48:14 comms audispd: queue is full - dropping event

I assume this indicates the problem - sending isn't happening so the
audispd queue fills. I'd have expected an audisp syslog error though.

lsof:
[root@hugo audit]# lsof | grep sdos
audisp-re 5082      root    3u     IPv4              92619
TCP comms:41065->dell1:tsdos390 (ESTABLISHED)

===================

On the collector I see:

[root@dell1 audit]#  lsof | grep sdos
auditd    5790      root    9u     IPv4              34892
TCP *:tsdos390 (LISTEN)
auditd    5790      root   10u     IPv4              35068
TCP comms:tsdos390->hugo:41065 (ESTABLISHED)

and nothing in the messages log.

I'm not seeing any of the events in the collector log from the sender
(reading the audit.log file directly until Steve's ausearch node= patch
is applied). 

I'm also sending between machines with the same MLS policy in permissive
mode. 

Any ideas? I guess I can go check the code where the send happens to see
if there is any debug I can add.

Thx,
LCB.


-- 
LC (Lenny) Bruzenak
lenny@magitekltd.com