On Friday 13 February 2009 03:11:26 pm Dan Gruhn wrote: > I'm using Prelude and Prewikka to view events and I see the master as a > sensor/source and its events, but I don't see the node. I thought that > once the audit/syslog information was making it to the central files the > rest would also work but that doesn't seem to be the case.
Prelude has its own messaging protocol. It picks things out of its configuration files to fill in various fields in its data packets. So, if you have the audit-prelude sensor reading aggregated logs, it won't know these are coming from all over the place. To use prelude the way it wants to be setup, you would have the audisp-prelude sensor on each machine sending to a central prelude-manager. Let audit send its data to its aggregator and prelude send its own data to its aggregator. Yes, there will be duplication...but it will work better. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
