<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="generator" content="Osso Notes">
<title></title></head>
<body>
<p>hi,
<br>
<br>first try to diagnose if audit messages actually make it to the local syslog-ng process (by logging them locally, or using the debug switch for syslog-ng)
<br>
<br>if they do, then work on what happens with these between syslog-ng & rsyslog, and then between rsyslog and octopussy.
<br>
<br>----- Original message -----
<br>> Hello ,
<br>>
<br>> Thank you for your comment but i have tried the same way also but it
<br>> seems the receiving server is not accepting the connection ...
<br>>
<br>> I have no idea how to configure the Octopussy server configured for
<br>> Rsyslog ... Any one have idea or configured the rsyslog for Octopussy
<br>> then please help.
<br>>
<br>> Below i am pasting the rsyslog server side configuration, and i have
<br>> enabled the "active=yes" on client Auditd configuration ... kindly look
<br>> into it once.
<br>>
<br>>
<br>> [<a href="mailto:root@octopussy">root@octopussy</a> ~]# cat /etc/rsyslog.conf
<br>> #################
<br>> #### MODULES ####
<br>> #################
<br>>
<br>> $ModLoad imuxsock # provides support for local system logging
<br>> $ModLoad imklog  # provides kernel logging support (previously done by
<br>> rklogd)
<br>> #$ModLoad immark  # provides --MARK-- message capability
<br>>
<br>> # provides UDP syslog reception
<br>> $ModLoad imudp
<br>> $UDPServerRun 514
<br>>
<br>> # provides TCP syslog reception
<br>> $ModLoad imtcp
<br>> $InputTCPServerRun 514
<br>>
<br>>
<br>> ###########################
<br>> #### GLOBAL DIRECTIVES ####
<br>> ###########################
<br>>
<br>> #
<br>> # Use traditional timestamp format.
<br>> # To enable high precision timestamps, comment out the following line.
<br>> #
<br>> #$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
<br>>
<br>> #
<br>> # Set the default permissions for all log files.
<br>> #
<br>> $FileOwner root
<br>> $FileGroup adm
<br>> $FileCreateMode 0640
<br>> $DirCreateMode 0755
<br>>
<br>> #
<br>> # Include all config files in /etc/rsyslog.d/
<br>> #
<br>> $IncludeConfig /etc/rsyslog.d/*.conf
<br>> [<a href="mailto:root@octopussy">root@octopussy</a> ~]# cat /etc/rsyslog.d/10-octopussy.conf
<br>> #########################################
<br>> #### GLOBAL DIRECTIVES FOR OCTOPUSSY ####
<br>> #########################################
<br>>
<br>> $FileOwner root
<br>> $FileGroup adm
<br>> $FileCreateMode 0640
<br>> $DirCreateMode 0750
<br>> $Umask 0022
<br>> $WorkDirectory /var/lib/octopussy/local/rsyslog
<br>> $CreateDirs on
<br>>
<br>> $MaxMessageSize 8k
<br>>
<br>> $ActionQueueMaxDiskSpace 1g
<br>> $ActionQueueFileName rsyslog
<br>> $ActionQueueHighWaterMark 250000
<br>> $ActionQueueLowWaterMark 200000
<br>> $ActionQueueType LinkedList # [FixedArray/LinkedList/Direct/Disk]
<br>> $ActionQueueSaveOnShutdown on
<br>> $ActionQueueWorkerThreads 1 # 1 cpu
<br>>
<br>> *.* |/var/spool/octopussy/octo_fifo
<br>>
<br>>
<br>> ###############
<br>> #### RULES ####
<br>> ###############
<br>>
<br>> # Remove all messages from other server
<br>> :hostname, !isequal, "octopussy" ~
<br>>
<br>> ++++++++++++++++++++++++++++++++++++++++++
<br>>
<br>>
<br>> On Tue, Aug 7, 2012 at 12:58 PM, Vámos Balázs
<br>> <<a href="mailto:vamos.balazs@zuriel.hu">vamos.balazs@zuriel.hu</a>>wrote:
<br>>
<br>> > Hi,
<br>> >
<br>> > Details:
<br>> >
<br>> > Open /etc/audisp/plugins.d/syslog.conf
<br>> > Set active = yes
<br>> > restart auditd
<br>> >
<br>> > With this configuration you do not need to use syslog-ng to read and
<br>> > send content of audit.log. Just forward the syslog as you usually do.
<br>> >
<br>> >
<br>> > Notice that the format of the syslog message will be a bit different:
<br>> >
<br>> > Aug  7 09:00:54 znb06 audispd: node=znb06 type=CWD
<br>> > msg=audit(1344322854.313:1056):  cwd="/"
<br>> > vs.
<br>> > Aug  7 09:00:54 znb06 your-tag: type=CWD
<br>> > msg=audit(1344322854.313:1056):  cwd="/"
<br>> >
<br>> >
<br>> > Regards,
<br>> >
<br>> > Balazs Vamos
<br>> > LOGalyze.com
<br>> >
<br>> >
<br>> > On 08/07/2012 07:35 AM, Balazs Scheidler wrote:
<br>> > >
<br>> > > Hi,
<br>> > >
<br>> > > you probably need to tell auditd to log to syslog on the client
<br>> > > hosts.
<br>> > >
<br>> > >
<br>> > > ----- Original message -----
<br>> > > > Hi Folks,
<br>> > > >
<br>> > > > Need your help !
<br>> > > >
<br>> > > > Want to configure a centralized Audit server (Currently the
<br>> > > > centralized server is running Octopussy Web interface,  which
<br>> > > > receives logs from remote hosts by Rsyslog ).
<br>> > > >
<br>> > > > The challenge and confusion here is .. all my linux clients are
<br>> > > > configured with syslog-ng and the daemon is sending all the system
<br>> > > > logs and kernel logs like messages,secure,cron logs etc ... with
<br>> > > > out any trouble.
<br>> > > >
<br>> > > > The problem is the syslog-ng daemon is not able to send the auidtd
<br>> > > > logs (/var/log/audit.log) to the Rsyslog server,
<br>> > > >
<br>> > > > Hence request your help to guide me how to setup the syslog-ng to
<br>> > > forward
<br>> > > > the audit.log to the remote Rsyslog server.
<br>> > > >
<br>> > > > It would be great if i can get client side and server side
<br>> > > configuration
<br>> > > > guidelines.
<br>> > > >
<br>> > > > --
<br>> > > > Thanks in Advance
<br>> > > > - Koresh
<br>> > >
<br>> > >
<br>> > >
<br>> > >
<br>> > ______________________________________________________________________________
<br>> > > Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
<br>> > > Documentation:
<br>> > <a href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a>
<br>> > > FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq">http://www.balabit.com/wiki/syslog-ng-faq</a>
<br>> > >
<br>> >
<br>> >
<br>> > ______________________________________________________________________________
<br>> > Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
<br>> > Documentation:
<br>> > <a href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a>
<br>> > FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq">http://www.balabit.com/wiki/syslog-ng-faq</a>
<br>> >
<br>> >
<br>>
<br>>
<br>> --
<br>>
<br>>
<br>> Thanks & Regards,
<br>>
<br>> - Koresh
<br><br></p>
</body>
</html>