Help with auditd.conf

[Steve Grubb]

On Tuesday 29 April 2008 02:23:34 pm Scott Ehrlich wrote:
> I have Snare Agent and audit 1.5.2 running on a CentOS 5.0 box and a RHEL
> 5.0 server.  I ideally would like audit logs to be sent to both the
> system's local audit.log file and to a log server.

We are working on this.

> I reviewed the /etc/audit/auditd.conf file and tried to play with things and
> move things around, but an active watch of my log server's /var/log/syslog
> and local machine's audit.log does NOT show simultaneous activity, leading
> me to think it is either one way or the other, and that simultaneous local
> and remote logging is not possible.
>
> Is there a way to get both?

audispd is the audit event multiplexer. To get audit logs in 
both /var/log/messages and /var/log/audit/audit.log, 
edit /etc/audisp/plugins.d/syslog.conf and change active to yes. Then restart 
the audit deamon. If you don't have /etc/audisp/plugins.d/syslog.conf, you 
need to upgrade to a newer audit package.

-Steve