Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a server running auditd and prelude with the audisdp-prelude plugin. Currently I get events for several types of logins, like sshd and gdm. However I don't seem to ever get login info for vsftpd. I know that I can change vsftpd's configuration and make it output to a file and then parse that with prelude-lml, but I really would prefer that auditd send me the event so that I don't have to do that. I can see that auditd is actually auditing the logins, but for some reason it doesn't forward them like it does for everything else. I am running a separate prelude-manager server that I'm trying to use to collect all my note worthy events.

share|improve this question

1 Answer 1

Sorry for the delay. Did you fix it ? If not, http://www.sriramrajan.com/mw/index.php/Linux-Auditd may be useful.

and generally ... In order to use audit facility you need to use following utilities => auditctl - a command to assist controlling the kernel’s audit system. You can get status, and add or delete rules into kernel audit system. Setting a watch on a file is accomplished using this command:

=> ausearch - a command that can query the audit daemon logs based for events based on different search criteria.

It says .... export your vsftpd logs via syslog into a file and make the filtering from auditd. It's something similar to what you was thinking about prelude-lml.

share|improve this answer
    
I actually wound up modifying auditd slightly so that it produced an actual event. The change I added only generated them for vsftpd anything else would still function as normal. –  tharris Oct 8 '12 at 15:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.