I have a server running auditd and prelude with the audisdp-prelude plugin. Currently I get events for several types of logins, like sshd and gdm. However I don't seem to ever get login info for vsftpd. I know that I can change vsftpd's configuration and make it output to a file and then parse that with prelude-lml, but I really would prefer that auditd send me the event so that I don't have to do that. I can see that auditd is actually auditing the logins, but for some reason it doesn't forward them like it does for everything else. I am running a separate prelude-manager server that I'm trying to use to collect all my note worthy events.
Sorry for the delay. Did you fix it ? If not, http://www.sriramrajan.com/mw/index.php/Linux-Auditd may be useful.
and generally ... In order to use audit facility you need to use following utilities => auditctl - a command to assist controlling the kernel’s audit system. You can get status, and add or delete rules into kernel audit system. Setting a watch on a file is accomplished using this command:
=> ausearch - a command that can query the audit daemon logs based for events based on different search criteria.
It says .... export your vsftpd logs via syslog into a file and make the filtering from auditd. It's something similar to what you was thinking about prelude-lml.