Re: [linux-audit/audit-userspace] Aureport on stream of data (Issue #324)
Burn Alting <[email protected]> Thu, 12 Oct 2023 21:43:37 +1100
| Newsgroups | com.redhat.linux-audit |
|---|---|
| Message-ID | <[email protected]> |
--===============2943934298631581196== Content-Type: multipart/alternative; boundary="=-DRFLLIKxebCl6nIXU0V5" --=-DRFLLIKxebCl6nIXU0V5 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 7bit Yes please, 2 questions : 1) Is there a way to run aureport on updating auditd logs ? That is, not running aureport on all logs, just updating the last aureport with the recent addition of logs ? 2) Could aureport run on combined auditd logs from more than one computor and produce multiple outputs ? Thank you To answer the above For 1. use the -checkpoint option of ausearch to generate the events. For 2. assuming you disseminate the source hosts on the aggregating host, again multiple invocations of ausearch will work with the -checkpoint option. Rgds --=-DRFLLIKxebCl6nIXU0V5 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable <html dir=3D"ltr"><head></head><body style=3D"text-align:left; direction:lt= r;"><div style=3D"margin-left: 3ch;"><span style=3D"caret-color: rgb(0, 0, = 0); color: rgb(0, 0, 0);">Yes please, 2 questions : </span></div><div = style=3D"margin-left: 3ch;"><br style=3D"caret-color: rgb(0, 0, 0); color: = rgb(0, 0, 0);"><span style=3D"caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0= );">1) Is there a way to run aureport on updating auditd logs ? That is, no= t </span><br style=3D"caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"= ><span style=3D"caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">running au= report on all logs, just updating the last aureport with the </span><b= r style=3D"caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><span style=3D"= caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">recent addition of logs ?&= nbsp;</span><br style=3D"caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><= span style=3D"caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">2) Could aur= eport run on combined auditd logs from more than one computor </span><= br style=3D"caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><span style=3D= "caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">and produce multiple outp= uts ? </span><br style=3D"caret-color: rgb(0, 0, 0); color: rgb(0, 0, = 0);"><br style=3D"caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><span st= yle=3D"caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">Thank you </sp= an><br style=3D"caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><div><span= style=3D"caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><br></span></div= ></div><div>To answer the above</div><div>For 1. use the -checkpoint option= of ausearch to generate the events.</div><div>For 2. assuming you dissemin= ate the source hosts on the aggregating host, again multiple invocations o= f ausearch will work with the -checkpoint option.</div><div><br></div><div>= Rgds</div></body></html> --=-DRFLLIKxebCl6nIXU0V5-- --===============2943934298631581196== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline -- Linux-audit mailing list [email protected] https://listman.redhat.com/mailman/listinfo/linux-audit --===============2943934298631581196==--