From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: Help with auditd.conf Date: Tue, 29 Apr 2008 14:56:04 -0400 Message-ID: <200804291456.04650.sgrubb@redhat.com> References: Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Tuesday 29 April 2008 02:23:34 pm Scott Ehrlich wrote: > I have Snare Agent and audit 1.5.2 running on a CentOS 5.0 box and a RHEL > 5.0 server. I ideally would like audit logs to be sent to both the > system's local audit.log file and to a log server. We are working on this. > I reviewed the /etc/audit/auditd.conf file and tried to play with things and > move things around, but an active watch of my log server's /var/log/syslog > and local machine's audit.log does NOT show simultaneous activity, leading > me to think it is either one way or the other, and that simultaneous local > and remote logging is not possible. > > Is there a way to get both? audispd is the audit event multiplexer. To get audit logs in both /var/log/messages and /var/log/audit/audit.log, edit /etc/audisp/plugins.d/syslog.conf and change active to yes. Then restart the audit deamon. If you don't have /etc/audisp/plugins.d/syslog.conf, you need to upgrade to a newer audit package. -Steve