audisp resend question
Steve or DJ,
Have you guys thought about how I can re-send submitter events from a client to a master auditd after failure?
I'm thinking of the case where the aggregating/collector machine has failed and the clients then shut down as configured.
Say the problem on the collector is fixed and it comes back up. Then we bring up the client sender machine(s).
I haven't tested this but I do not think the missed events will get sent right?
How can I try to resend the events to the collector? I apologize if there is a way I've missed. I think it would be possible to write the events to a separate file and resend those on restart. But even if there is a manual/semi-manual way to do this it beats nothing in my case.
Thx,
LCB.
Signature · 2 lines
LC (Lenny) Bruzenak [email protected]
Quoted 4 lines · On Thursday 04 December 2008 12:21:29 LC Bruzenak wrote:
Say the problem on the collector is fixed and it comes back up. Then we bring up the client sender machine(s).
I haven't tested this but I do not think the missed events will get sent right?
Correct.
Quoted 1 line
How can I try to resend the events to the collector?
All audisp plugins take their data from stdin. You can pipe the raw output of ausearch into audisp-remote and it should do the right thing.
-Steve
Quoted 1 line · Steve Grubb
On Thursday 04 December 2008 12:21:29 LC Bruzenak wrote:
...
Quoted 5 lines
Quoted 2 lines
How can I try to resend the events to the collector?
All audisp plugins take their data from stdin. You can pipe the raw output of ausearch into audisp-remote and it should do the right thing.
OK, works for me...the last sent message on the collector is identifiable, but do timestamps (with full precision) work as input to the "-ts" switch?
I don't know how to remove duplicates (probably not be an issue anyway).
Thx,
LCB.
Signature · 2 lines
LC (Lenny) Bruzenak [email protected]
Quoted 6 lines · On Thursday 04 December 2008 12:52:54 LC Bruzenak wrote:
Quoted 2 lines
All audisp plugins take their data from stdin. You can pipe the raw output of ausearch into audisp-remote and it should do the right thing.
OK, works for me...the last sent message on the collector is identifiable, but do timestamps (with full precision) work as input to the "-ts" switch?
Not at this point. Ausearch always shows the converted time unless you do a -- raw.
Quoted 1 line
I don't know how to remove duplicates (probably not be an issue anyway).
Aureport is about the only thing that cares. Also, a duplicate boot/login/logout will also affect aulast.
-Steve