New answers tagged

0

Another idea would be to mount the drive using cifs https://access.redhat.com/solutions/448263 You can test it using this: mount -t cifs -o username=<share user>,password=<share password>,domain=example.com //WIN_PC_IP/<share name> /mnt You can add this to the /etc/fstab to make it mount on boot: //WIN_PC_IP/<share name> /<...


0

You could probably use smbclient with credentials to copy the files, redirecting commands into it. It has a lot of similar syntax to ftp. man smbclient to get a manpage (or search on your favorite search engine). Something like, maybe: echo 'cp /var/log/audit/audit* \some\windows\dir'|smbclient //host/share -A mycredentials.txt The documentation also ...


0

Simplest (but batch orientated): Use the checkpoint capability within ausearch, serialize the output into some transport mechanism (ie fold multiple records into a single line and transport via syslog and have your logstash macros break it out again) and run every N minutes. More effort: Cut code to do the above using audit-libs (start with auparse-feed(3)) ...


0

Can I suggest you post your /etc/audit/audit.rules file (or the files in /etc/audit/rules.d) and we may be able to make some recommendations based on what you actually want (you'd need to advise us of this also)


0

ausearch is meant to return a complete event, not just a single record of the event (ie the TYPE=EXECVE record). Unless you write your own code (see man auparse_feed), I believe you are stuck with a grep. If you accept your fate of spinning your own code or grepping, I'd suggest you also look at the -i option to ausearch (or equivalent in code). If you are ...



Top 50 recent answers are included