[Spacewalk-list] Audit logging.

[Musayev, Ilya]

Stepan

Would you please post a sample screenshot of what you get through Audit – I’m debating if I need to go through the hassle of implementing – if its not getting us much.. if the screenshot – too revealing, then just specify the details.

Thanks
ilya

From: spacewalk-list-bounces at redhat.com [mailto:spacewalk-list-bounces at redhat.com] On Behalf Of Stepan Rogov
Sent: Wednesday, July 18, 2012 9:53 AM
To: spacewalk-list at redhat.com
Subject: Re: [Spacewalk-list] Audit logging.

On 18.07.2012 17:11, Joshua Roys wrote:
On 07/18/2012 06:35 AM, Stepan Rogov wrote:

Well, I do the following:

Host named spacewalk.

1. I created a directory /var/satellite/systemlogs/spacewalk/audit/

2. Parse the audit log using the ausearch  and aup and sent results to
the file /
var/satellite/systemlogs/spacewalk/audit/audit-1342555201-1342641599.parsed
ausearch -r -ts 07/18/2012 00:00:01 -te 07/18/2012 23:59:59 | /root/
aup> /var/satellite/systemlogs/spacewalk/audit/audit- `date-d
"07/18/2012 00:00:01" +% s `-` date-d "07/18/2012 23:59:59" +% s `. parsed

3. In the spacewalk moved on the Auditing tab, and nothing appeared.

Hello,

Please try setting the following in /etc/rhn/rhn.conf:

web.audit.logdir = /var/satellite/systemlogs

And then restart tomcat.  Also, make sure that /var/satellite/systemlogs/*/audit/* are readable by tomcat all the way up from / (use `namei -m /var/satellite/systemlogs/spacewalk/audit` for example).

Thanks,

Josh
It's work!
Thank you very much!
It is necessary to correct the spacewalk wiki.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/spacewalk-list/attachments/20120718/d96800a6/attachment.htm>