[Spacewalk-list] Audit logging.

Jan Hutař jhutar at redhat.com
Thu Jul 19 07:08:16 UTC 2012


On Wed, 18 Jul 2012 09:11:49 -0400 Joshua Roys
<Joshua.Roys at gtri.gatech.edu> wrote:

> On 07/18/2012 06:35 AM, Stepan Rogov wrote:
> > Well, I do the following:
> >
> > Host named spacewalk.
> >
> > 1. I created a
> > directory /var/satellite/systemlogs/spacewalk/audit/
> >
> > 2. Parse the audit log using the ausearch  and aup and sent
> > results to the file /
> > var/satellite/systemlogs/spacewalk/audit/audit-1342555201-1342641599.parsed
> > ausearch -r -ts 07/18/2012 00:00:01 -te 07/18/2012 23:59:59
> > | /root/
> > aup> /var/satellite/systemlogs/spacewalk/audit/audit- `date-d
> > "07/18/2012 00:00:01" +% s `-` date-d "07/18/2012 23:59:59" +
> > % s `. parsed
> >
> > 3. In the spacewalk moved on the Auditing tab, and nothing
> > appeared.
> >
> 
> Hello,
> 
> Please try setting the following in /etc/rhn/rhn.conf:
> 
> web.audit.logdir = /var/satellite/systemlogs
> 
> And then restart tomcat.  Also, make sure that 
> /var/satellite/systemlogs/*/audit/* are readable by tomcat all
> the way up from / (use `namei
> -m /var/satellite/systemlogs/spacewalk/audit` for example).
> 
> Thanks,
> 
> Josh

I have added that info to the wiki.

Regards,
Jan



-- 
Jan Hutar     Systems Management QA
jhutar at redhat.com     Red Hat, Inc.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/spacewalk-list/attachments/20120719/2d16e44f/attachment.sig>


More information about the Spacewalk-list mailing list