Bump to version 2.0.0 to avoid versionning confusing (1.9 > 1.14)
Some more documentation in the readme
This commit is contained in:
Родитель
96959df0a7
Коммит
f14839127e
2
Makefile
2
Makefile
|
@ -18,7 +18,7 @@
|
|||
# Authors:
|
||||
# Guillaume Destuynder <gdestuynder@mozilla.com>
|
||||
|
||||
VERSION := 1.14
|
||||
VERSION := 2.0.0
|
||||
|
||||
#FPM options, suggestions:
|
||||
# --replaces audisp-cef
|
||||
|
|
11
README.rst
11
README.rst
|
@ -13,6 +13,10 @@ The JSON format used is MozDef message format.
|
|||
|
||||
Regular audit log messages and audisp-json error, info messages still use syslog.
|
||||
|
||||
|
||||
Due to the ring buffer filling up when the front-end HTTP server does not process fast enough, the program may slowly
|
||||
grow in memory for a while on busy systems. It'll stop at 512 messages (hard-coded) buffered.
|
||||
|
||||
Building
|
||||
--------
|
||||
|
||||
|
@ -69,6 +73,13 @@ Example for syslog-ng
|
|||
filter f_not_auditd { not message("type=[0-9]* audit") or not message("error converting sid to string"); };
|
||||
log{ source(s_syslog);f ilter(f_not_auditd); destination(d_logserver); };
|
||||
|
||||
Misc other things to do
|
||||
=======================
|
||||
|
||||
- It is suggested to bump the audispd queue to adjust for extremely busy systems, for ex. q_depth=512.
|
||||
- You will also probably need to bump the kernel-side buffer and change the rate limit in audit.rules, for ex. -b 16384
|
||||
-r 500.
|
||||
|
||||
Message handling
|
||||
----------------
|
||||
|
||||
|
|
Загрузка…
Ссылка в новой задаче