Announcing austream

[Matthew Booth]

austream is a utility to stream audit logs to a remote hosts via syslog.
Its features are:

* Works on both auditd and laus (on laus it's a dispatcher)
* Messages sent immediately off-node
* Sends syslog packets directly, without going through syslogd
* Very low overhead, even at extreme volume (8,000 events/sec)

Tested platforms are RHEL 4 U4+ and RHEL 3 U8+.

There are a few caveats, though. Foremost is the fact that it's not a
dispatcher: it replaces auditd. This is because, to date, development
has been tightly focused on a single set of requirements.

It's still under development. Some bigger items on my todo list are:
* Message inspection to turn PATH records into absolute paths
* Limited output buffering
* Option to run as a dispatcher
* Host it somewhere

The git repository is available at git://heisenbug.com/austream.git.
Please have a look. Patches welcome.

To build:
./configure TARGET=(laus|auditd)
make
or
make rpm

If you build the auditd rpm, when it installs it will add itself
to /etc/inittab. Make sure you configure the destination
in /etc/sysconfig/austream before doing 'telinit q'.

Matt
-- 
Matthew Booth, RHCA, RHCSS
Red Hat, Global Professional Services

M:       +44 (0)7977 267231
GPG ID:  D33C3490
GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20070912/17e0dc4f/attachment.sig>