<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
On 05/27/2013 08:38 PM, Aly Khimji wrote:
<blockquote
cite="mid:CAJMZt_b5babSE=HkUrGdJcgacnaXCK_fKTYgJCjSUj1FUOi_3w@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>Hey Guys,</div>
<div><br>
</div>
</div>
</blockquote>
<br>
Hello Aly,<br>
<br>
You are touching on the areas that are dear to our interests too.
Unfortunately we have not had time to do the research.<br>
What you are asking about should be possible but have not been tried
by us, at least we are not aware.<br>
<br>
Here are some thoughts:<br>
1. It should be possible to configure rsyslog to process logs
emitted by other applications (389, Dogtag, MIT KDC, httpd etc.).
You need to research the documentation on how to do it by Rainer
(farther of rsyslog) assured that it is possible.<br>
2. Issue (or use exiting) kerberos principal for the GSS API to
secure rsyslog to rsyslog communication. I know of one deployment
that planned to do it but I do not know the results.<br>
<a class="moz-txt-link-freetext" href="http://www.rsyslog.com/doc/gssapi.html">http://www.rsyslog.com/doc/gssapi.html</a><br>
3. Use GSS proxy to do rsyslog to rsyslog communication so that the
tickets acquired and renewed as needed.<br>
I think to do this you need to install gss-proxy package and add
couple env vars to the rsyslog systemd profile: <br>
<pre class="jive-pre"><code class="jive-code">GSS_USE_PROXY=1
GSSPROXY_BEHAVIOR=REMOTE_FIRST
</code></pre>
<code class="jive-code"></code>There is not much documentation about
GSS proxy so do not hesitate to ask.<br>
<a class="moz-txt-link-freetext" href="https://fedorahosted.org/gss-proxy/">https://fedorahosted.org/gss-proxy/</a><br>
<br>
(Honza, Gunther, please add any other pointers)<br>
<code class="jive-code"></code><br>
4. Use logstash with grok and elastic search at the end point to
process the logs and provide a nice correlation tool.<br>
<br>
<a class="moz-txt-link-freetext" href="http://logstash.net/">http://logstash.net/</a><br>
<br>
<br>
5. Come back with your findings :-)<br>
<br>
<br>
Thanks<br>
Dmitri<br>
<br>
<blockquote
cite="mid:CAJMZt_b5babSE=HkUrGdJcgacnaXCK_fKTYgJCjSUj1FUOi_3w@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>Quick question, is it possible to have all components of
FreeIPA send logs to a central log source, or even better to
the FreeIPA's local rsyslogd and then I will have rsyslod send
all logs to a central logging server?</div>
<div><br>
</div>
<div>As per the link, each component logs to a separate
location </div>
<div><a moz-do-not-send="true"
href="http://docs.fedoraproject.org/en-US/Fedora/15/html/FreeIPA_Guide/server-config.html">http://docs.fedoraproject.org/en-US/Fedora/15/html/FreeIPA_Guide/server-config.html</a></div>
<div><br>
</div>
<div>16.1.3. Checking FreeIPA Server Logs</div>
<div>FreeIPA unifies several different Linux services, so it
relies on those services' native logs for tracking and
debugging those services. The other services (Apache, 389
Directory Server, and Dogtag Certificate System) all have
detailed logs and log levels. </div>
<div><br>
</div>
<div>Just wondering as its for audit purposes and will be sent
to a centeral logger/alerter.</div>
<div><br>
</div>
<div>Thanks</div>
<div><br>
</div>
<div>Aly</div>
<div style="">
<div class="" id="tab.ipa-logs"
style="line-height:15px;padding-top:0px;color:rgb(0,0,0);font-family:'liberation
sans','Myriad ','Bitstream Vera Sans','Lucida Grande','Luxi
Sans','Trebuchet
MS',helvetica,verdana,arial,sans-serif;font-size:12px">
</div>
</div>
<div style=""><br>
</div>
<div style=""><br>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Freeipa-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a>
<a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a></pre>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
Thank you,
Dmitri Pal
Sr. Engineering Manager for IdM portfolio
Red Hat Inc.
-------------------------------
Looking to carve out IT costs?
<a class="moz-txt-link-abbreviated" href="http://www.redhat.com/carveoutcosts/">www.redhat.com/carveoutcosts/</a>
</pre>
</body>
</html>