<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> <meta name="Generator" content="Microsoft Word 15 (filtered medium)"> <style></style> </head> <body lang="EN-US" link="#0563C1" vlink="#954F72"> <div class="WordSection1"> Hello, I hope you all are well and meeting your own professional challenges very well.<o:p></o:p> <o:p> </o:p> <o:p> </o:p> I have a scenario that I need a little help understanding how to work through in an isolated environment of 1 server and 6 workstations (7 machines).<o:p></o:p> The 7 machines are all running CentOS-6.7 and selinux = disabled.<o:p></o:p> All 6 workstations are configured through rsyslog.conf to send audit data to the server, and I have (but apparently not successfully configured general system messages to also report back to the same server).<o:p></o:p> I am using the conventional filesystems for each, but the directory structure below is different.<o:p></o:p> <o:p> </o:p> For audit, I use, /var/log/audit/2016/04/27/wk{1..6}_audit.log the directory per day and per month and per year are auto created (miraculously).<o:p></o:p> For system messages, and I know this isn’t the forum to get help on this so I will only list the directory is - /var/log/2016/04/27/wk{1..6}_syslog.log.<o:p></o:p> <o:p> </o:p> Now that I am doing this, and successfully, I want to test that the security auditors will be able to do their job properly, as well as I am trying to comply with some security constraint that requires me to centralize the logdata into a single server (hence the major driver for all of this).<o:p></o:p> <o:p> </o:p> I know that there is the aureport and ausearch command, but I am not sure that I am able to figure out the correct command-line structure to test that audit-data is getting into the appropriate file, on each day of the year, on a per serverName basis.<o:p></o:p> <o:p> </o:p> If a real-world situation occurred that the Security Auditors were asking to find out how many machines did userX attempt to log into, what would be the appropriate command for the example audit directory I listed above (/var/log/audit/2016/04/27/wk{1..6}_audit.log), because I am not sure I am running the command with the appropriate switches to scan the files properly?<o:p></o:p> <o:p> </o:p> I used:<o:p></o:p> <![if !supportLists]>· <![endif]>aureport –if /var/log/audit/2016/04/27/ and it didn’t like the input,<o:p></o:p> <![if !supportLists]>· <![endif]>aureport –if /var/log/audit/2016/04/27/* and it didn’t like the input,<o:p></o:p> am I using the command improperly?<o:p></o:p> <o:p> </o:p> <o:p> </o:p> <o:p> </o:p> <o:p> </o:p> Warron French, MBA, SCSA<o:p></o:p> </div> </body> </html>