/
githubmirror
/
audit-userspace
Обзор
Документация
Войти
/
githubmirror
/
audit-userspace
Код
Запросы
0
Пакеты
0
Релизы
0
Аналитика
Безопасность
master
audisp/plugins/syslog/audisp-syslog.8
24 строки
1 KB
Steve Grubb
Correct path of config file
12 апр 2023, 22:13
12 апр 2023, 22:13
aa4293c
Код
Авторство
О чём код?
.TH AUDISP-SYSLOG "8" "August 2018" "Red Hat" "System Administration Utilities" .SH NAME audisp-syslog \- plugin to push audit events into syslog .SH SYNOPSIS .B audisp-syslog [ \fIOPTIONS\fP ] .SH DESCRIPTION \fBaudisp-syslog\fP is a plugin for the audit event dispatcher that wraps audit events back around to syslog. It can be passed three options: one which is the syslog facility, one that is the syslog level that all events are logged with, and one that determines if events should be interpreted. Valid facilities are LOG_LOCAL0 through 7, LOG_AUTH, LOG_AUTHPRIV, LOG_DAEMON, LOG_SYSLOG, and LOG_USER. Valid levels are LOG_DEBUG through LOG_EMERG. Setting these options is done in the /etc/audit/syslog.conf file on the args line. If it is desired that events are interpreted, add the word .B interpret to the args line. This will cause all events to be interpreted. The drawback to this approach is that naive parsers can be tricked by an adversary that has the ability to name files, processes, or other user controlled objects. If you are aggregating multiple machines, you should edit auditd.conf to set the name_format to something meaningful and the log_format to enriched. This way you can tell where the event came from and have the user name and groups resolved locally before it is sent off of the machine. .SH FILES /etc/audit/plugins/syslog.conf /etc/audit/auditd.conf .SH "SEE ALSO" .BR auditd.conf (8), .BR auditd-plugins (5), .BR syslog (3). .SH AUTHOR Steve Grubb