[Spacewalk-list] Audit logging.

[Joshua Roys]

On 07/18/2012 06:35 AM, Stepan Rogov wrote:
> Well, I do the following:
>
> Host named spacewalk.
>
> 1. I created a directory /var/satellite/systemlogs/spacewalk/audit/
>
> 2. Parse the audit log using the ausearch  and aup and sent results to
> the file /
> var/satellite/systemlogs/spacewalk/audit/audit-1342555201-1342641599.parsed
> ausearch -r -ts 07/18/2012 00:00:01 -te 07/18/2012 23:59:59 | /root/
> aup> /var/satellite/systemlogs/spacewalk/audit/audit- `date-d
> "07/18/2012 00:00:01" +% s `-` date-d "07/18/2012 23:59:59" +% s `. parsed
>
> 3. In the spacewalk moved on the Auditing tab, and nothing appeared.
>

Hello,

Please try setting the following in /etc/rhn/rhn.conf:

web.audit.logdir = /var/satellite/systemlogs

And then restart tomcat.  Also, make sure that 
/var/satellite/systemlogs/*/audit/* are readable by tomcat all the way 
up from / (use `namei -m /var/satellite/systemlogs/spacewalk/audit` for 
example).

Thanks,

Josh


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5059 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/spacewalk-list/attachments/20120718/932ac3b7/attachment.p7s>