From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dan Gruhn Subject: Re: Central Audit Server with Prelude and Prewikka - RHEL5 Date: Fri, 13 Feb 2009 16:45:38 -0500 Message-ID: <4995EA02.8060200@groupw.com> References: <499455ED.3060208@groupw.com> <499460FF.3050400@groupw.com> <4995D3EE.3020005@groupw.com> <200902131527.31766.sgrubb@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Return-path: Received: from mx3.redhat.com (mx3.redhat.com [172.16.48.32]) by int-mx1.corp.redhat.com (8.13.1/8.13.1) with ESMTP id n1DLk8Vr029393 for ; Fri, 13 Feb 2009 16:46:08 -0500 Received: from smtp.group-w-inc.com (group-w-inc.com [70.164.45.3]) by mx3.redhat.com (8.13.8/8.13.8) with ESMTP id n1DLjeD5016798 for ; Fri, 13 Feb 2009 16:45:41 -0500 Received: from smtp.group-w-inc.com (localhost.localdomain [127.0.0.1]) by localhost (Postfix) with ESMTP id DD1EBDA009F for ; Fri, 13 Feb 2009 16:45:38 -0500 (EST) Received: from [10.1.1.218] (dgruhn-f9.group-w-inc.com [10.1.1.218]) by smtp.group-w-inc.com (Postfix) with ESMTP id 99C85DA0094 for ; Fri, 13 Feb 2009 16:45:38 -0500 (EST) In-Reply-To: <200902131527.31766.sgrubb@redhat.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com Steve, Thanks for the advice. I was wondering about duplicating those information streams and needed the encouragement to go ahead. One thing that did come up, I changed a lot of "localhost" references in the "Audit + Prelude HOWTO" and in the /etc/prelude/default/client.conf files to my actual server name (master) and I also changed a line in /etc/prelude-manager/prelude-manager.conf from listen = 127.0.0.1 to listen = master All of these changes required me to revoke my old prelude-manager registrations under "localhost" and re-register all of the sensors to "master". Perhaps I didn't need all of this but it is all working now (except for my 5.2 SELinux problem). I'm running prelude-lml on the master and I'll be figuring out if I should run it on each node or it will pick up everything from the master's /var/log/messages file. I'm thinking it would be better to keep things separate but I'll be testing. If anyone can tell me if some of those "localhost" changes were not necessary it would be helpful to know for future reference. I could update the "Audit + Prelude HOWTO" with what I've found and send it to back to Steve if that would be useful. Dan Steve Grubb wrote: > On Friday 13 February 2009 03:11:26 pm Dan Gruhn wrote: > >> I'm using Prelude and Prewikka to view events and I see the master as a >> sensor/source and its events, but I don't see the node. I thought that >> once the audit/syslog information was making it to the central files the >> rest would also work but that doesn't seem to be the case. >> > > Prelude has its own messaging protocol. It picks things out of its > configuration files to fill in various fields in its data packets. So, if you > have the audit-prelude sensor reading aggregated logs, it won't know these > are coming from all over the place. > > To use prelude the way it wants to be setup, you would have the audisp-prelude > sensor on each machine sending to a central prelude-manager. Let audit send > its data to its aggregator and prelude send its own data to its aggregator. > Yes, there will be duplication...but it will work better. > > -Steve > > -- > Linux-audit mailing list > Linux-audit@redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit > -- Dan Gruhn Group W Inc. 8315 Lee Hwy, Suite 303 Fairfax, VA, 22031 PH: (703) 752-5831 FX: (703) 752-5851