Audit Logs and EventLog Analyzer
Dan Gruhn
Dan.Gruhn at groupw.com
Wed Jan 14 19:54:17 UTC 2009
John Dennis wrote:
> Dan Gruhn wrote:
>> I'm currently using AdventNet's EventLog Analyzer for auditing of a
>> secure Windows machine and thought it would be nice to use for a
>> secure RHEL 5.2 cluster as well since people would only need to use
>> one interface. It seems to do well with the syslog entries, but I
>> don't see anything about getting the auditd/ audit.log entries into
>> it. Can anyone point me to some information on how to do this or
>> should I give up on this and go the Prewikka route?
> Isn't this a question for AdventNet?
I have posted the same question on their forum.
>
> * How do you currently get the syslog data into AdventNet? Are you
> directing AdventNet to read /var/log/message? Is AdventNet reading a
> syslog socket?
The EventLog Analyzer (ELA) is monitoring port 6514 to receive
information that would normally go to rsyslog (it could use 514, but I
wanted to keep it separate).
>
> * Log analyzers need to understand the contents of a log file, does
> AdventNet know how to parse and interpret audit data?
As far as I can tell from reading through their forums and website it
doesn't currently handle the audit.log format.
>
> Basically you can feed audit log data to an analyzer in two different
> ways, tell it to monitor the /var/log/audit/audit.log file or write a
> audispd plugin which sends the audit data to the analyzer (code is
> simple). But first you had better check AdventNet can parse and
> understand the data.
A pointer to a HowTo on audispd plugins would be appreciated, but I
thought perhaps someone had already done this and I wouldn't have to
write something on my own. You can't blame a guy for hoping.
Dan
More information about the Linux-audit
mailing list