ausearch on the fly
Steve Grubb
sgrubb at redhat.com
Fri Dec 20 19:23:34 UTC 2019
On Friday, December 20, 2019 8:33:11 AM EST MAUPERTUIS, PHILIPPE wrote:
> We are centralizing the audit logs with rsyslog.
> The SIEM behind the central log server is unable to process the raw logs.
> We would like to push the ausearch result in CSV format in real time or
> near real time. Is there a way to have ausearch working from a pipe and
> and waiting when no logs are received
I think that I've seen others who setup a cron job and use the checkpointing
feature so that they do not miss anything. You can pipe its output into
logger. You probably also want to cut the first line which has the column
headers.
ausearch --start today --checkpoint /root/last-ausearch .chpt --format csv | tail -n +2 | logger
Also, the latest syslog plugin can now do interpretation. I think its in
alpha-9 which dates back to Nov 04, 2019.
It really shouldn't be hard to copy and paste the code from ausearch into the
syslog plugin to log directly in that format. I wonder if anyone else would
find that useful?
-Steve
More information about the Linux-audit
mailing list