<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>When using a freshly installed version of U16.04, I found that the linux audit log parser does not seem to be installed.</p>
<p>For example: <font size="2"><span style="font-size:10pt;"><br>
</span></font></p>
<p><font size="2"><span style="font-size:10pt;"><br>
</span></font></p>
<p><font size="2"><span style="font-size:10pt;"></span></font><span>syslog-ng --module-registry|grep audit</span> <-- returns nothing</p>
<p>==</p>
<p><br>
</p>
<ol>
<li>This started because I experienced a failure when trying to enable the linux audit parser:
<div><i>Error parsing parser expression, parser plugin linux-audit-parser not found in /etc/syslog-ng/conf.d/auditd.log.conf at line 3, column 8:<br>
included from /etc/syslog-ng/syslog-ng.conf line 164, column 1<br>
<br>
linux-audit-parser(prefix(".auditd."));</i></div>
</li><li>The corresponding conf file is below:</li></ol>
<i>source s_var_log_audit.log { file("/var/log/audit/audit.log" flags(no-parse)); };</i><br>
<i>parser p_audit_syslog_parser {<br>
linux-audit-parser(prefix(".auditd."));<br>
};<br>
<br>
log {<br>
source(s_var_log_audit.log);<br>
parser(p_audit_syslog_parser);<br>
destination(d_midfin_logger_2);<br>
};</i><br>
<br>
<p>The officially supported version of syslog-ng in ubuntu is 3.5.1.</p>
<p>==</p>
<p></p>
<div><i>syslog-ng 3.5.6<br>
Installer-Version: 3.5.6<br>
Revision: 3.5.6-2.1 [@416d315] (Ubuntu/16.04)<br>
Compile-Date: Oct 24 2015 03:49:19<br>
Available-Modules: json-plugin,csvparser,system-source,tfgeoip,afsocket-notls,afamqp,basicfuncs,affile,afsocket-tls,dbparser,afmongodb,cryptofuncs,afsmtp,linux-kmsg-format,afuser,redis,afsocket,afstomp,sysl\<br>
ogformat,confgen,afprog,afsql<br>
Enable-Debug: off<br>
Enable-GProf: off<br>
Enable-Memtrace: off<br>
Enable-IPv6: on<br>
Enable-Spoof-Source: on<br>
Enable-TCP-Wrapper: on<br>
Enable-Linux-Caps: on<br>
Enable-Pcre: on<br>
</i></div>
<i><br>
</i>
<p></p>
<p><i></i>Do I need to install an unofficial version or is there some elementary mistake that I am making.</p>
<p>thanks</p>
<p>Varugis<br>
</p>
</div>
</body>
</html>