Central Audit Server with Prelude and Prewikka - RHEL5

[Dan Gruhn <Dan.Gruhn@groupw.com>]

Greetings,

I have a 64 bit EL 5.2 system that I have built and installed all of the 
necessary packages for the latest audit (1.7.11-1), prelude and prewikka.

This all seems to be working fine on the central cluster server and I 
have set up a client in a cluster node to report its audit information 
to the server.  This seems to be working in that I see both the master 
and the node reporting their information in the master's 
/var/log/messages and /var/log/audit/audit.log.  I still have an issue 
with SELinux and the port connection, but I'm running in permissive mode 
for now.

I'm using Prelude and Prewikka to view events and I see the master as a 
sensor/source and its events, but I don't see the node.  I thought that 
once the audit/syslog information was making it to the central files the 
rest would also work but that doesn't seem to be the case.

Steve's "Audit + Prelude HOWTO" has been quite helpful, but it describes 
putting the client and server all on one machine (which I have working) 
and I'm just not getting what to change to add another client.  I don't 
have prelude-manager running on the client, but it seems as though I 
don't need that.  Could someone give me a pointer on where to look for 
the problem?

Thanks,

Dan