Recently I've been switching over my embedded distro to relying on systemd for logging. The thought crossed my mind that it would be convenient if auditd supported storing log information in systemd's journal with the sd-journal API. It would be great if syslog data and audit log data were stored in systemd's journal so common a interface could be used to query, send alerts, generate reports, etc.
I suppose several different approaches could be taken: 1) Use audispd's builtin syslog plugin to send the events to syslog which in my case would be systemd storing them to the journal. The problem with this would be that all of the event information would be stored in the message, it would be much more useful if each audit log field resulted in a journal field. 2) Write an audispd plugin that used the sd-journal API to store audit events in the journal. 3) Add sd-journal as a log format to auditd. Does anyone have any thoughts/comments on why this would be either a good or bad idea? Further more if I don't receive convincing arguments why this shouldn't be I'll probably take a shot a write a patch to add it, so any tips/suggestions relevant would be greatly appreciated. Thanks, George McCollister -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
