up vote 6 down vote favorite
2
share [g+] share [fb]

I'm running several RHEL based systems which utilize the audit functionality within the 2.6 kernel to track user activity and I need to have these logs sent to centralized SYSLOG servers for monitoring and event correlation. Anyone know how to achieve this?

link|improve this question
25% accept rate
As an aside, I recommend checking out the CIS Benchmark for RHEL 5.0/5.1 for some advice on making auditd more useful. – Scott Pack Nov 15 '10 at 16:27
@packs - Do you have a link handy? I'm interested.. – Aaron Copley Nov 15 '10 at 16:32
1  
@Aaron - You can start here cisecurity.org/en-us/?route=downloads.multiform. Unless your organization is a member, you'll accept the license. – Scott Pack Nov 15 '10 at 16:44
@packs - Thanks! That's why I couldn't find it so easily. (I'll have to register.) – Aaron Copley Nov 15 '10 at 16:48
feedback

3 Answers

up vote 4 down vote accepted

If you are running the stock ksyslogd syslog server I don't know how to do this. But there are great instructions for doing it with rsyslog at their Wiki. ( http://wiki.rsyslog.com/index.php/Centralizing_the_audit_log )

I will summarize:

On the sending client (rsyslog.conf)
# auditd audit.log
$InputFileName /var/log/audit/audit.log
$InputFileTag tag_audit_log:
$InputFileStateFile audit_log
$InputFileSeverity info
$InputFileFacility local6
$InputRunFileMonitor

On the receiving server (rsyslog.conf)
$template HostAudit, "/var/log/rsyslog/%HOSTNAME%/audit_log"
local6.*

Note that the imfile module will need to have been loaded previously in the rsyslog configuration. Restart the service on both hosts and you should begin receiving auditd messages.

link|improve this answer
Unfortunately, (but for an acceptable reason) syslog is not an output option with auditd, so you have to do it something like this. – Scott Pack Nov 15 '10 at 16:26
Down voted and no explanation... I wonder who it was? – Aaron Copley Nov 15 '10 at 16:44
Sweet!! Thanks for the quick reply Aaron. – syn- Nov 15 '10 at 17:12
Just FYI for anyone else setting this up, the config line required for loading imfile is: "$ModLoad imfile" More information on the module can be found here: rsyslog.com/doc/imfile.html – syn- Nov 15 '10 at 19:23
If your on a production/busy server and sending logs, this is not an efficient way of doing this.. imfile utilizes polling, whereby your wasting cpu cycles always for watching the file.. – Arenstar Nov 16 '10 at 3:26
feedback
up vote 1 down vote

You can log directly to syslog using audisp, it's part of Audit package. In Debian (I haven't tried in other distros yet) edit /etc/audisp/plugins.d/syslog.conf and set active=yes.

link|improve this answer
feedback
up vote -1 down vote

http://linux.die.net/man/5/audisp-remote.conf
use this for audit-sysloging

Its quite easy, on your "clients" sending logs

yum install rsyslog
chkconfig syslog off
chkconfig rsyslog on
/etc/init.d/syslog stop

edit your /etc/rsyslog.conf add at the bottom

*.* @ipaddress:port  #(use @@ to use tcp ) ( this sends all logs BTW)

Then start the daemon

/etc/init.d/rsyslog start

I would suggest using syslog-ng to capture on the "syslog server"..
http://code.google.com/p/php-syslog-ng/
I personally use Logzilla for viewing my logs, but you can also use splunk, or a cacti module

Any other questions??

link|improve this answer
1  
I don't believe this is going to get him the audit.log, only the standard syslog. – Aaron Copley Nov 15 '10 at 16:19
I said that ( sends all logs that go to syslog ) im actually looking now for the correct way to do it.. :) – Arenstar Nov 15 '10 at 16:20
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.