<html><head></head><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:13px"><div id="yui_3_16_0_1_1450103069543_42824"><span>Steve,</span></div><div id="yui_3_16_0_1_1450103069543_42833"><br><span></span></div><div id="yui_3_16_0_1_1450103069543_42882"><span id="yui_3_16_0_1_1450103069543_42881">The last place I was at heavily used Splunk and then transitioned to dual-routing a substantial portion of the logs from across the infrastructure to ELK, as well.</span></div><div id="yui_3_16_0_1_1450103069543_42908"><br><span id="yui_3_16_0_1_1450103069543_42881"></span></div><div id="yui_3_16_0_1_1450103069543_42909"><span id="yui_3_16_0_1_1450103069543_42881">-Joe</span></div><br> <div id="yui_3_16_0_1_1450103069543_42744" style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 13px;"> <div id="yui_3_16_0_1_1450103069543_42743" style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div id="yui_3_16_0_1_1450103069543_42742" dir="ltr"> <font id="yui_3_16_0_1_1450103069543_42741" size="2" face="Arial"> <hr id="yui_3_16_0_1_1450103069543_42883" size="1"> <b id="yui_3_16_0_1_1450103069543_42740"><span id="yui_3_16_0_1_1450103069543_42739" style="font-weight:bold;">From:</span></b> Steve Grubb <sgrubb@redhat.com><br> <b><span style="font-weight: bold;">To:</span></b> F Rafi <farhanible@gmail.com>; "linux-audit@redhat.com" <linux-audit@redhat.com> <br> <b><span style="font-weight: bold;">Sent:</span></b> Monday, December 14, 2015 10:34 AM<br> <b id="yui_3_16_0_1_1450103069543_42823"><span id="yui_3_16_0_1_1450103069543_42822" style="font-weight: bold;">Subject:</span></b> Re: New draft standards<br> </font> </div> <div id="yui_3_16_0_1_1450103069543_42801" class="y_msg_container"><br>But I guess this gives me an opportunity to ask the community what tools they <br clear="none">are using for audit log collection and viewing? Its been a couple years since <br clear="none">e had this discussion on the mail list and I think some things have changed.<br clear="none"><br clear="none">Do people use ELK?<br clear="none">Apache Flume?<br clear="none">Something else?<br clear="none"><br clear="none">It might be possible to write a plugin to translate the audit logs into the <br clear="none">native format of these tools.<br clear="none"><br clear="none"><div class="qtdSeparateBR"><br><br></div><div class="yqt8267957563" id="yqtfd57097">-Steve<br clear="none"><a id="yui_3_16_0_1_1450103069543_42910" shape="rect" href="https://www.redhat.com/mailman/listinfo/linux-audit" target="_blank"></a><br clear="none"></div><br><br></div> </div> </div></div></body></html>