|
BSM Data on Linux box..Suggestions?
I have a solaris box which runs 24x7 auditing functions which log diverse sets of different processes on a totally isolated LAN. The solaris box saves the audit logs as BSM Files....The security audit app on the Solaris box utilizes tools such as praudit and auditreduce. IN case you were wondering, each tool analyzes the BSM files either by outputting the BSM data in a Human Readable format or drilling down into the BSM data files to determine specific auditing results.
Now, I have a Linux box that I will be utilizing in the mix on a seperate LAN, completely isolated from the Solaris box. The BSM files are handed off via hard drive. I've seen a few things out there like openbsm or freebsm, i've had great difficulty installing these apps on my Kubuntu Machine (Feisty). Can anyone recommend some possible solutions for viewing the BSM data on my Kubuntu box in a readable format? Also, I wanted to throw out the application "Splunk" anyone use this search app before? I'll leave it at that, hoping to open this up with some more ideas/suggestions as I'm fairly new to Linux.
|
