Welcome to the most active Linux Forum on the web.
Go Back > Forums > Linux Forums > Linux - Security
User Name
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.


  Search this Thread
Old 06-01-2010, 12:47 PM   #1
Registered: Mar 2010
Distribution: zLinux, RHEL, Ubuntu, SUSE
Posts: 50

Rep: Reputation: 16
remote audit

I've setup audit and a logging server to receive audit messages. There is a another system I want to audit, on a different network. If I point that system to the system that can talk to the audit server, will audit records waterfall over?

i.e. can I do

system A audit -> system B audit -> logging system?

will audit be forwarded? or does this issue require more convoluted work?

Old 06-01-2010, 10:43 PM   #2
Senior Member
Registered: Nov 2004
Location: Texas
Distribution: RHEL, Scientific Linux, Debian, Fedora
Posts: 3,935
Blog Entries: 5

Rep: Reputation: Disabled
The right answer would be to get a request in to change network ACLs / packet filtering rules so that system A could send messages directly to the logging system. In the arrangement you describe, accurate capture of system A's logs is fully dependent on system B. (What if system B runs into trouble and goes offline?)

I haven't actually tested what you're describing, but I would think that if system A sends log messages that match the facility/level that system B is already configured to send to the logging system they'd get sent there together. (Only one way to find out for sure, though. Test it.)
Old 06-02-2010, 11:21 AM   #3
Registered: Mar 2010
Distribution: zLinux, RHEL, Ubuntu, SUSE
Posts: 50

Original Poster
Rep: Reputation: 16
ACLs and packet filtering rules like that for other reasons are specifically not allowed; Testing it sounds about the only way to verify then, thanks!


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
How can I read the audit time stamp? msg=audit(1213186256.105:20663) abefroman Linux - Software 3 04-21-2011 06:37 PM
error in line 5 of /etc/audit/audit.rules RHEL5u3 abti Red Hat 1 04-06-2010 05:42 PM
How to save audit logs to remote host. Rossonero224 Linux - Security 2 12-28-2009 01:20 AM
Audit Logging Phaethar Linux - Software 0 11-07-2007 03:31 PM
Audit Pranesh Linux - Software 0 08-05-2003 09:13 AM > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 06:29 AM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration