[Spacewalk-list] Audit logging.

[Stepan Rogov]

On 18.07.2012 17:11, Joshua Roys wrote:
> On 07/18/2012 06:35 AM, Stepan Rogov wrote:
>> Well, I do the following:
>>
>> Host named spacewalk.
>>
>> 1. I created a directory /var/satellite/systemlogs/spacewalk/audit/
>>
>> 2. Parse the audit log using the ausearch  and aup and sent results to
>> the file /
>> var/satellite/systemlogs/spacewalk/audit/audit-1342555201-1342641599.parsed 
>>
>> ausearch -r -ts 07/18/2012 00:00:01 -te 07/18/2012 23:59:59 | /root/
>> aup> /var/satellite/systemlogs/spacewalk/audit/audit- `date-d
>> "07/18/2012 00:00:01" +% s `-` date-d "07/18/2012 23:59:59" +% s `. 
>> parsed
>>
>> 3. In the spacewalk moved on the Auditing tab, and nothing appeared.
>>
>
> Hello,
>
> Please try setting the following in /etc/rhn/rhn.conf:
>
> web.audit.logdir = /var/satellite/systemlogs
>
> And then restart tomcat.  Also, make sure that 
> /var/satellite/systemlogs/*/audit/* are readable by tomcat all the way 
> up from / (use `namei -m /var/satellite/systemlogs/spacewalk/audit` 
> for example).
>
> Thanks,
>
> Josh
>
It's work!
Thank you very much!
It is necessary to correct the spacewalk wiki.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/spacewalk-list/attachments/20120718/a15de83f/attachment.htm>