[redhat-lspp] audit messages during bootup

[Dustin Kirkland]

On Fri, 2006-01-06 at 16:42 +1100, Russell Coker wrote:
> I find it difficult to imagine a situation where NFS would be an
> appropriate way of dealing with audit data.  I also find it difficult to
> imagine why anyone who has a serious need for auditd (as opposed to the
> majority who either just want it for SE Linux events or who don't even
> know what it is) would even want to run NFS3 on their machines.

I can think of a few advantages logging to networked filesystems offers:

1) the ability to retain vastly larger logs
2) centralized location for audit logs of multiple machines
3) remote data in the case of system failure/crash/compromise

:-Dustin
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
URL: <http://listman.redhat.com/archives/redhat-lspp/attachments/20060106/3bfaf991/attachment.sig>