Remotely logging audit rules.

[Stephen J. Smoogen]

I got a development request to see how much work it would take to do.
Our policy wags want to have all object audit events (or whatever the
real term for that is...)  to be sent both locally and remotely. The
reason is a supposed policy for checking the local logs against remote
logs to see if they have been tampered with and for being able to
train a SIM to look for events in the centralized logs.

My 5000 foot question is how would the best way to implement this be?
For the current RHEL 4 I would probably need some sort of tail -f xxx
| logger type script.


--
Stephen J Smoogen.
CSIRT/Linux System Administrator