Comments on: A Brief Introduction to auditd http://security.blogoverflow.com/2013/01/a-brief-introduction-to-auditd/ The Security Stack Exchange Blog Sat, 06 Feb 2016 05:11:22 +0000 hourly 1 https://wordpress.org/?v=4.5.6 By: Dwight Spencer http://security.blogoverflow.com/2013/01/a-brief-introduction-to-auditd/#comment-499574 Sun, 07 Jun 2015 20:09:07 +0000 http://security.blogoverflow.com/?p=936#comment-499574 A central logging system is going to fit this use case. Logstash, Logentries and Splunk all give a great user experence and have powerful quering languages.

However, I would incurrage one to use logstash/elasticsearch since the free version of splunk and logentries do have several caviates when going over data storage or bandwidth restrictions.

Also, one can utilize fluentd and collectd+statsd+graphana with logstash and get a better picture of what is going on with ones environment footprint. With fluentd one can even create actionable agents based on the alerts to preform basic procedual administrative tasks via abutraial execuables. (ie, kill long running tasks, null route ddos, launch additional running virtual instances in ones cloud)

]]> By: tdurden http://security.blogoverflow.com/2013/01/a-brief-introduction-to-auditd/#comment-499128 Wed, 03 Jun 2015 16:49:38 +0000 http://security.blogoverflow.com/?p=936#comment-499128 splunk is $$, try greylog2..

]]> By: Bob Cat http://security.blogoverflow.com/2013/01/a-brief-introduction-to-auditd/#comment-491435 Wed, 25 Mar 2015 11:22:28 +0000 http://security.blogoverflow.com/?p=936#comment-491435 Have you tried the Linux Auditd app for Splunk? https://splunkbase.splunk.com/app/2642/

]]> By: Jason http://security.blogoverflow.com/2013/01/a-brief-introduction-to-auditd/#comment-154065 Thu, 12 Sep 2013 13:36:34 +0000 http://security.blogoverflow.com/?p=936#comment-154065 Nice quick overview of auditd. Are there any good open source reporting tools out there for monitoring the logs across many servers? I’m thinking either a dashboard or daily email with changed files. It’d also be nice to crosscheck with puppet reports to see that a file was changed intentionally. If not, then I’m considering rolling my own using logstash and elasticsearch.

]]>