Hi, I'm testing version 1.7.9 of audit using audisp-prelude plugin and I have some problems:
1. audisp-prelude plugin is not generating events when a user is logged in. 2. audisp-prelude plugin is not sending uid, gid to a prelude-manager 3. No events are generate for watched files/exec/mk_exe if no tow -k options are specified in the rule. One of the -k options should contain '-k ids-type-severity' and another -k may contain anything. If you specify only one -k options no events are generated. Another question is how I can use audisp-remote to send events somewhere remote? Thx, Loredan Stancu -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
