Re: [PATCH] Add auditd listener and remote audit protocol

John Dennis
2008-08-14T23:16:54Z

[-- Attachment #1.1: Type: text/plain, Size: 703 bytes --]

LC Bruzenak wrote:
> On Thu, 2008-08-14 at 19:00 -0400, John Dennis wrote:
>
>> DJ Delorie wrote:
>>
>>> The net result is to aggregate audit logs from many systems onto one
>>> central audit server. Remote audit messages have the new "node=" tag
>>> on them so you know where they came from.
>>>
>>>
>> The field name was "host", is the "node=" a typo or did the field name
>> change?
>>
>>
>
> Mine say "node=".
>

The "host" field was added to audit records almost a year ago, although
if memory serves me correctly you have to enable it as a configuration
option. Is the node field redundant with host or did node supercede host?

--
John Dennis <jdennis@redhat.com>

[-- Attachment #1.2: Type: text/html, Size: 1312 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]