From mboxrd@z Thu Jan 1 00:00:00 1970 From: Sebastien Tricaud Subject: Re: audisp-remote and audisp-prelude question Date: Tue, 24 Mar 2009 17:55:11 +0100 Message-ID: <1237913711.3670.11.camel@roken.inl.fr> References: <200902271033.21486.sgrubb@redhat.com> <1235751224.7212.24.camel@homeserver> <200902271156.55861.sgrubb@redhat.com> <1237912188.9480.258.camel@homeserver> Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (mx1.redhat.com [172.16.48.31]) by int-mx1.corp.redhat.com (8.13.1/8.13.1) with ESMTP id n2OGtZ8S022508 for ; Tue, 24 Mar 2009 12:55:35 -0400 Received: from ks301150.kimsufi.com (home.regit.org [91.121.73.151]) by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id n2OGtGuB013606 for ; Tue, 24 Mar 2009 12:55:16 -0400 In-Reply-To: <1237912188.9480.258.camel@homeserver> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: LC Bruzenak Cc: Linux Audit List-Id: linux-audit@redhat.com On Tue, 2009-03-24 at 11:29 -0500, LC Bruzenak wrote: > > However, logins on the remote machine which are sent to the collector > log do not make it into the prelude DB (at least prewikka doesn't show > them). I have no prewikka filters and I have the prewikka viewer set to > "1 day". Hi, can you see events coming to prelude-manager when running: prelude-manager --debug ? Thanks, Sebastien.