[PATCH] Add auditd listener and remote audit protocol

[John Dennis]

LC Bruzenak wrote:
> On Thu, 2008-08-14 at 19:00 -0400, John Dennis wrote:
>   
>> DJ Delorie wrote:
>>     
>>> The net result is to aggregate audit logs from many systems onto one
>>> central audit server.  Remote audit messages have the new "node=" tag
>>> on them so you know where they came from.
>>>   
>>>       
>> The field name was "host", is the "node=" a typo or did the field name 
>> change?
>>
>>     
>
> Mine say "node=".
>   

The "host" field was added to audit records almost a year ago, although 
if memory serves me correctly you have to enable it as a configuration 
option. Is the node field redundant with host or did node supercede host?

-- 
John Dennis <jdennis at redhat.com>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20080814/e3c8d9c1/attachment.htm>