Hello list,
I had FreeIPA audit log on. I feed audit logs to Graylog. Since there are
multiple lines of logs for each event, I could not find a suitable
extractor to parse the logs. Therefore, the logs are very hard to read.
Could anyone in the list share how you process the logs if you are in a
similar situation?
Thanks!
Kathy.