[Spacewalk-list] Audit logging.
Jan Hutař
jhutar at redhat.com
Thu Jul 19 07:08:16 UTC 2012
On Wed, 18 Jul 2012 09:11:49 -0400 Joshua Roys
<Joshua.Roys at gtri.gatech.edu> wrote:
> On 07/18/2012 06:35 AM, Stepan Rogov wrote:
> > Well, I do the following:
> >
> > Host named spacewalk.
> >
> > 1. I created a
> > directory /var/satellite/systemlogs/spacewalk/audit/
> >
> > 2. Parse the audit log using the ausearch and aup and sent
> > results to the file /
> > var/satellite/systemlogs/spacewalk/audit/audit-1342555201-1342641599.parsed
> > ausearch -r -ts 07/18/2012 00:00:01 -te 07/18/2012 23:59:59
> > | /root/
> > aup> /var/satellite/systemlogs/spacewalk/audit/audit- `date-d
> > "07/18/2012 00:00:01" +% s `-` date-d "07/18/2012 23:59:59" +
> > % s `. parsed
> >
> > 3. In the spacewalk moved on the Auditing tab, and nothing
> > appeared.
> >
>
> Hello,
>
> Please try setting the following in /etc/rhn/rhn.conf:
>
> web.audit.logdir = /var/satellite/systemlogs
>
> And then restart tomcat. Also, make sure that
> /var/satellite/systemlogs/*/audit/* are readable by tomcat all
> the way up from / (use `namei
> -m /var/satellite/systemlogs/spacewalk/audit` for example).
>
> Thanks,
>
> Josh
I have added that info to the wiki.
Regards,
Jan
--
Jan Hutar Systems Management QA
jhutar at redhat.com Red Hat, Inc.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/spacewalk-list/attachments/20120719/2d16e44f/attachment.sig>
More information about the Spacewalk-list
mailing list