Created
September 15, 2016 10:59
-
-
Save markuskont/14d5642a82130e5016f8019a746d8b6e to your computer and use it in GitHub Desktop.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| destination d_auditd { | |
| file("/var/log/auditd.json" template("$(format-json .auditd.*)\n")); | |
| }; | |
| parser p_auditd { | |
| linux-audit-parser (prefix(".auditd.")); | |
| }; | |
| filter f_auditd {program("audispd")}; | |
| #log { | |
| # source(s_remote_bsd); | |
| # source(s_remote_ietf); | |
| # source(s_remote_tcp); | |
| # source(s_src); | |
| # filter(f_auditd); | |
| # parser(p_auditd); | |
| # destination(d_auditd); | |
| #}; |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Process Auditd syslog messages into JSON. Tested on syslog-ng 3.8