From: Steve Grubb <sgrubb@redhat.com>
To: linux-audit@redhat.com
Cc: Richard Guy Briggs <rgb@redhat.com>, Max Timchenko <maxvt@bu.edu>
Subject: Re: Running multiple audit service clients
Date: Fri, 12 Feb 2016 14:13:28 -0500 [thread overview]
Message-ID: <1517388.eVATBq3Yqu@x2> (raw)
In-Reply-To: <CAF6gGuApsX4J3NFXxqwJ4VAm-eHiW1zpGvJCfFpuyNq7oC8y1w@mail.gmail.com>
On Thursday, February 11, 2016 03:19:27 PM Max Timchenko wrote:
> I have read the docs on audispd(8) - is it something auditd and the other
> client could use to enable multiple access? It sounds like audispd does
> support multiple clients, but I would guess all clients would have to use
> the audispd plugin interface instead of the usual kernel API.
Yes. This is intentional and has existed for about 10 years.
> What is missing from the documentation for me is the relationship between
> audispd and auditd - whether audispd is an optional component of auditd that
> can run concurrently
Yes. If you look in auditd.conf, you will see that there is a configuration
option, dispatcher, which allows you to select another consumer of audit
events. Normally the selection of /sbin/audispd is the best because it allows
"unlimited" multiplexing of the audit stream.
You can send events to syslog, setroubleshoot, and remotely log events in an
aggregator all at the same time.
> , or audispd is a replacement of auditd when configured
> (and then auditd cannot run on the same machine
> without running into the same multi-client issues).
No. The audispd man page says, "audispd is an audit event multiplexor. It has
to be started by the audit daemon in order to get events."
HTH...
-Steve
next prev parent reply other threads:[~2016-02-12 19:13 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-02-10 21:28 Running multiple audit service clients Max Timchenko
2016-02-11 2:30 ` Richard Guy Briggs
2016-02-11 8:16 ` Paul Moore
2016-02-11 20:19 ` Max Timchenko
2016-02-12 4:39 ` Richard Guy Briggs
2016-02-12 19:13 ` Steve Grubb [this message]
2016-02-12 18:50 ` Steve Grubb
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1517388.eVATBq3Yqu@x2 \
--to=sgrubb@redhat.com \
--cc=linux-audit@redhat.com \
--cc=maxvt@bu.edu \
--cc=rgb@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox