More info on remote logging

[Steve Grubb]

On Tuesday 18 May 2010 11:05:55 am Konstantin Ryabitsev wrote:
> On Tue, May 18, 2010 at 10:43 AM, Steve Grubb <sgrubb at redhat.com> wrote:
> > On Tuesday 18 May 2010 10:27:32 am Konstantin Ryabitsev wrote:
> >> I'm interested in sending audit logs to a central logging server. One
> >> option is using the builtin syslog plugin for audisp, but I also see
> >> audisp-remote that mentions sending logs to a remote server.
> >> Unfortunately, I'm having trouble finding more information about that
> >> (such as "what kind of a remote server" and "how do you set up a
> >> remote server").
> > 
> > auditd is the remote server. Look at the auditd.conf man page starting at
> > the tcp_listen_port entry to see what options you have available. One
> > thing to note, I do not enable the kerberos support right now on any Red
> > Hat or Fedora release.
> 
> Ah, okay -- I suspected as such but wanted to make sure. Is there a
> way to send audit data encrypted if kerberos is not enabled?

Not by auditd and audisp-remote. There may be ways of creating an encrypted 
tunnel between the systems if need be. 

Also note that the remote logging capability is listed as "In Tech Preview" 
status if RHEL is involved. There are a few odds and ends that need some 
development work, such as a "store and forward" mode so that the audit system 
is lossless. Right now, the audit events in transit to a remote system only 
exist in memory and if the system oopses, all events in memory are lost.


> > Sure. If you want to file a RFE bugzilla, please do.
> 
> Created as
> https://bugzilla.redhat.com/show_bug.cgi?id=593340

Thanks.

-Steve