Tools for reviewing audit logs ?

[Steve Grubb]

On Wednesday 13 December 2006 11:36, Jonathan Abbey wrote:
> I'm guessing that was Leigh Purdie and the Snare team down at
> Intersect Alliance in oz. 

It wasn't Leigh, it was someone else about a month later.

> They are providing/recommending 'audit-1.2.1-1.i386.rpm' and
> 'audit-libs-1.2.1-1.i386.rpm' in addition to their
> SnareLinux-1.0b7-1.i386.rpm, 

Hopefully that is "or higher".

> but I'm not sure why that's necessary, given that RHEL4 should be providing
> those pieces (albeit with lower version numbers?) out of  the box.

RHEL4 did not have the dispatcher interface in it right away. I wanted to 
study the problem a little more since the API might change based on real use 
scenarios.

I think we've gotten enough runtime now to see how its working out and I've 
backported it - which became the 1.0.15 release. I have another set of 
updates to make and I'll release a 1.0.16 version and that should make it to 
the U5 release. So, that would be the first RHEL4 version that could support 
such a setup.

-Steve