From: Steve Grubb <sgrubb@redhat.com>
To: LC Bruzenak <lenny@magitekltd.com>
Cc: linux-audit@redhat.com
Subject: Re: audisp-remote and audisp-prelude question
Date: Tue, 24 Mar 2009 14:13:39 -0400 [thread overview]
Message-ID: <200903241413.40030.sgrubb@redhat.com> (raw)
In-Reply-To: <1237917699.9989.9.camel@homeserver>
On Tuesday 24 March 2009 14:01:39 LC Bruzenak wrote:
> Asked another way, what stops the aggregated audit events from creating
> a prelude event?
Prelude grabs things from its own config files to fill in certain fields. This
means that if run from an aggregator, it will use the same values for all
events. This affects the host names that show up in heartbeats and other
events.
The two are meant to be separate but complimentary systems.
-Steve
next prev parent reply other threads:[~2009-03-24 18:13 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-02-27 15:33 Near Term Audit Road Map Steve Grubb
2009-02-27 16:13 ` LC Bruzenak
2009-02-27 16:23 ` LC Bruzenak
2009-02-27 16:56 ` Steve Grubb
2009-03-24 16:29 ` audisp-remote and audisp-prelude question LC Bruzenak
2009-03-24 16:41 ` Steve Grubb
2009-03-24 16:55 ` Sebastien Tricaud
2009-03-24 17:30 ` LC Bruzenak
2009-03-24 17:06 ` Steve Grubb
2009-03-24 18:01 ` LC Bruzenak
2009-03-24 18:13 ` Steve Grubb [this message]
2009-02-27 20:59 ` Near Term Audit Road Map Matthew Booth
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200903241413.40030.sgrubb@redhat.com \
--to=sgrubb@redhat.com \
--cc=lenny@magitekltd.com \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox