Central Audit Server with Prelude and Prewikka - RHEL5
Steve Grubb
sgrubb at redhat.com
Fri Feb 13 20:27:31 UTC 2009
On Friday 13 February 2009 03:11:26 pm Dan Gruhn wrote:
> I'm using Prelude and Prewikka to view events and I see the master as a
> sensor/source and its events, but I don't see the node. I thought that
> once the audit/syslog information was making it to the central files the
> rest would also work but that doesn't seem to be the case.
Prelude has its own messaging protocol. It picks things out of its
configuration files to fill in various fields in its data packets. So, if you
have the audit-prelude sensor reading aggregated logs, it won't know these
are coming from all over the place.
To use prelude the way it wants to be setup, you would have the audisp-prelude
sensor on each machine sending to a central prelude-manager. Let audit send
its data to its aggregator and prelude send its own data to its aggregator.
Yes, there will be duplication...but it will work better.
-Steve
More information about the Linux-audit
mailing list