tyler.durden
/
harbian-audit
mirror of https://github.com/hardenedlinux/harbian-audit.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add description for audispd-plugins package bug to how_to_deploy_audisp_remote_for_audit_log.mkd.

This commit is contained in:
Samson-W 2019-04-21 00:36:37 +08:00
parent 647d94d11c
commit 13764a9869
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
docs/configurations/manual-operation-docs/how_to_deploy_audisp_remote_for_audit_log.mkd
View File

@ -37,6 +37,13 @@ remote_server = 172.16.237.135
port = 60
local_port = 2006
```
In audispd-plugins version is 1:2.6.7-2, need to replace queue_error to queue_error_action, because this version has a bug:
```
The queue_error configuration item in the configuration file
etc/audisp/audisp-remote.conf is inconsistent with the MAN document
(usr/share/man/man5/audisp-remote.conf.5.gz). The MAN document is
queue_error_action.
```
If not record logs on local filesystem, Modify /etc/audit/auditd.conf:
```