On Wed, 12 Oct 2011 09:46:17 +0200
Jan-Frode Myklebust <janfrode(a)tanso.net> wrote:
> Thoughts? downsides? Alternate plans?
Auditd supports both logging to syslog
(ref: /etc/audisp/plugins.d/syslog.conf) and to remote audit servers
trough audispd-plugins (/etc/audisp/plugins.d/au-remote.conf).
Would it not be better to use one of those ?
Perhaps? What does that get us? Ability to filter?
What do we want to filter out?
kevin