CentOS - Jul 2015 - rsyslog.conf

On Thu, Jul 23, 2015 at 01:19:44PM -0400, m.roth at 5-cent.us
wrote:
> I really am going crazy, trying to deal with the hourly logs from the
> loghost. We've got 170+ servers and workstations... but a *very* large
> percentage of what's showing up is from his bloody new fedora 22, with
its
> idiot systemd logging of *ever* selinux message to /var/log/messages.
systemctl enable auditd
systemctl start auditd

Now your SELinux (and other audit) logs are going to
/var/log/audit/audit.log. 

-- 
Jonathan Billings <billings at negate.org>

Jonathan Billings wrote:
> On Thu, Jul 23, 2015 at 01:19:44PM -0400, m.roth at 5-cent.us wrote:
>> I really am going crazy, trying to deal with the hourly logs from the
>> loghost. We've got 170+ servers and workstations... but a *very*
large
>> percentage of what's showing up is from his bloody new fedora 22,
with
>> its
>> idiot systemd logging of *ever* selinux message to /var/log/messages.
>
> systemctl enable auditd
> systemctl start auditd
>
> Now your SELinux (and other audit) logs are going to
> /var/log/audit/audit.log.
Um, no. That was where I started this thread - my manager updated his
fedora box from 20 to 22, and there's a bug about it
<https://bugzilla.redhat.com/show_bug.cgi?id=1227379>, where it appears
that the systemd folks have demanded *all* logs, and are multicast
spitting out the selinux logs *als0* to /var/log/messages.

And I just checked, and yes, auditd is running.

So I'm back to trying to find the correct syntax to filter all the
successes seen by auditd from getting to messages....

       mark

On Thu, Jul 23, 2015 at 2:17 PM,  <m.roth at 5-cent.us>
wrote:
> https://bugzilla.redhat.com/show_bug.cgi?id=1227379

There's ~4 aspects to that bug so it's just going to have to settle
out, with the main one being comment 25 where systemd-journald is
enabling audit and inappropriately mixing data with different
discretion levels.

-- 
Chris Murphy