On Wed, 2008-12-03 at 18:53 +0200, Loredan Stancu wrote: > > On Wed, 2008-12-03 at 17:28 +0200, Loredan Stancu wrote: > > ... > Supposing the remote system is an SElinux machine (a machine which stores > all the user activity send by audisp-remote plugins. There are more then > one machine for which I want to store events) what should I do on this > machine to keep separate file events for each machine
A couple of different ways to do this: 1: Leave the events in the original log but create new duplicates - periodically parse using ausearch and filter the output on "node" to different file (now) - use the auparse library on logfiles - see audit-1.7.9/auparse/test/ for examples (custom) - also possibly use the af_unix plugin as per setroubleshoot for event access (custom) - write a patch for a new audisp plugin (custom) 2: MY favorite: ask Steve how to make the aggregating side flexible in this regard. We may need a BZ filed or a consensus about what is important on this list. I also would like a separation based on time to allow for an easier archive/restore capability...and maybe that built in if possible! :) Separation based on node is also a potential "good thing". Anyway, the point is if there was a official audit modification to enable this, the data would not be duplicated as it would above. LCB. -- LC (Lenny) Bruzenak [EMAIL PROTECTED] -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
