Re: Central Audit Server with Prelude and Prewikka - RHEL5

[Steve Grubb <sgrubb@redhat.com>]

On Friday 13 February 2009 03:11:26 pm Dan Gruhn wrote:
> I'm using Prelude and Prewikka to view events and I see the master as a
> sensor/source and its events, but I don't see the node.  I thought that
> once the audit/syslog information was making it to the central files the
> rest would also work but that doesn't seem to be the case.

Prelude has its own messaging protocol. It picks things out of its 
configuration files to fill in various fields in its data packets. So, if you 
have the audit-prelude sensor reading aggregated logs, it won't know these 
are coming from all over the place.

To use prelude the way it wants to be setup, you would have the audisp-prelude 
sensor on each machine sending to a central prelude-manager. Let audit send 
its data to its aggregator and prelude send its own data to its aggregator. 
Yes, there will be duplication...but it will work better.

-Steve