audisp resend question

audisp resend question

[LC Bruzenak]

Steve or DJ,

Have you guys thought about how I can re-send submitter events from a
client to a master auditd after failure?

I'm thinking of the case where the aggregating/collector machine has
failed and the clients then shut down as configured.

Say the problem on the collector is fixed and it comes back up.
Then we bring up the client sender machine(s).
I haven't tested this but I do not think the missed events will get sent
right?

How can I try to resend the events to the collector? I apologize if
there is a way I've missed. I think it would be possible to write the
events to a separate file and resend those on restart. But even if there
is a manual/semi-manual way to do this it beats nothing in my case.

Thx,
LCB.

-- 
LC (Lenny) Bruzenak
lenny@magitekltd.com

Re: audisp resend question

[Steve Grubb]

On Thursday 04 December 2008 12:21:29 LC Bruzenak wrote:
> Say the problem on the collector is fixed and it comes back up.
> Then we bring up the client sender machine(s).
> I haven't tested this but I do not think the missed events will get sent
> right?

Correct.


> How can I try to resend the events to the collector?

All audisp plugins take their data from stdin. You can pipe the raw output of 
ausearch into audisp-remote and it should do the right thing.

-Steve

Re: audisp resend question

[LC Bruzenak]

On Thu, 2008-12-04 at 12:42 -0500, Steve Grubb wrote:
> On Thursday 04 December 2008 12:21:29 LC Bruzenak wrote:
...
> 
> > How can I try to resend the events to the collector?
> 
> All audisp plugins take their data from stdin. You can pipe the raw output of 
> ausearch into audisp-remote and it should do the right thing.

OK, works for me...the last sent message on the collector is
identifiable, but do timestamps (with full precision) work as input to
the "-ts" switch? 

I don't know how to remove duplicates (probably not be an issue anyway).

Thx,
LCB.

-- 
LC (Lenny) Bruzenak
lenny@magitekltd.com

Re: audisp resend question

[Steve Grubb]

On Thursday 04 December 2008 12:52:54 LC Bruzenak wrote:
> > All audisp plugins take their data from stdin. You can pipe the raw
> > output of ausearch into audisp-remote and it should do the right thing.
>
> OK, works for me...the last sent message on the collector is
> identifiable, but do timestamps (with full precision) work as input to
> the "-ts" switch?

Not at this point. Ausearch always shows the converted time unless you do a --
raw.


> I don't know how to remove duplicates (probably not be an issue anyway).

Aureport is about the only thing that cares. Also, a duplicate 
boot/login/logout will also affect aulast.

-Steve