ausearch on the fly

[MAUPERTUIS, PHILIPPE]

Hi,
I should have read the man more carefully.
I missed the point that --input can be a directory and not only a single file as I wrongly assumed.
That solves any problems I had.

Philippe

De : Burn Alting [mailto:burn.alting at iinet.net.au]
Envoyé : samedi 8 février 2020 01:39
À : MAUPERTUIS, PHILIPPE; Steve Grubb; linux-audit at redhat.com
Objet : Re: ausearch on the fly

Phillipe,

To close this off, yes, you will need to investigate making use of the --input option.  You
may also want to consider having a central syslog directory structure that allows you to simulate the local directory structure (/var/log/audit)
by having a revolving set of audit.log, audit.log.1, etc files and age them off to your raw archive once you have processed them.

My preference is to enrich the logs via ausearch on the local host as this mitigates a number of risks (lost logs as per this discussion, local uids)
and then send the results to a central log management capability.

Regards
Burn

On Fri, 2020-02-07 at 12:44 +0000, MAUPERTUIS, PHILIPPE wrote:
Hi,
I should have been more precise in my question.
I want to run this ausearch on the central log server, not on the original server.
Very likely i need to specify the input file in that.
And this input file would need to be rotated outside auditd
Philippe

Envoyé depuis mon mobile Orange


Snip

equensWorldline is a registered trade mark and trading name owned by the Worldline Group through its holding company.
This e-mail and the documents attached are confidential and intended solely for the addressee. If you receive this e-mail in error, you are not authorized to copy, disclose, use or retain it. Please notify the sender immediately and delete this email from your systems. As emails may be intercepted, amended or lost, they are not secure. EquensWorldline and the Worldline Group therefore can accept no liability for any errors or their content. Although equensWorldline and the Worldline Group endeavours to maintain a virus-free network, we do not warrant that this transmission is virus-free and can accept no liability for any damages resulting from any virus transmitted. The risks are deemed to be accepted by everyone who communicates with equensWorldline and the Worldline Group by email
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20200210/550d5893/attachment.htm>