Greetings,
I have a 64 bit EL 5.2 system that I have built and installed all of the
necessary packages for the latest audit (1.7.11-1), prelude and prewikka.
This all seems to be working fine on the central cluster server and I
have set up a client in a cluster node to report its audit information
to the server. This seems to be working in that I see both the master
and the node reporting their information in the master's
/var/log/messages and /var/log/audit/audit.log. I still have an issue
with SELinux and the port connection, but I'm running in permissive mode
for now.
I'm using Prelude and Prewikka to view events and I see the master as a
sensor/source and its events, but I don't see the node. I thought that
once the audit/syslog information was making it to the central files the
rest would also work but that doesn't seem to be the case.
Steve's "Audit + Prelude HOWTO" has been quite helpful, but it describes
putting the client and server all on one machine (which I have working)
and I'm just not getting what to change to add another client. I don't
have prelude-manager running on the client, but it seems as though I
don't need that. Could someone give me a pointer on where to look for
the problem?
Thanks,
Dan
--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
