Bump to version 2.0.0 to avoid versionning confusing (1.9 > 1.14)

Some more documentation in the readme
This commit is contained in:
Guillaume Destuynder 2015-06-05 18:54:23 -07:00
Родитель 96959df0a7
Коммит f14839127e
2 изменённых файлов: 12 добавлений и 1 удалений

Просмотреть файл

@ -18,7 +18,7 @@
# Authors: # Authors:
# Guillaume Destuynder <gdestuynder@mozilla.com> # Guillaume Destuynder <gdestuynder@mozilla.com>
VERSION := 1.14 VERSION := 2.0.0
#FPM options, suggestions: #FPM options, suggestions:
# --replaces audisp-cef # --replaces audisp-cef

Просмотреть файл

@ -13,6 +13,10 @@ The JSON format used is MozDef message format.
Regular audit log messages and audisp-json error, info messages still use syslog. Regular audit log messages and audisp-json error, info messages still use syslog.
Due to the ring buffer filling up when the front-end HTTP server does not process fast enough, the program may slowly
grow in memory for a while on busy systems. It'll stop at 512 messages (hard-coded) buffered.
Building Building
-------- --------
@ -69,6 +73,13 @@ Example for syslog-ng
filter f_not_auditd { not message("type=[0-9]* audit") or not message("error converting sid to string"); }; filter f_not_auditd { not message("type=[0-9]* audit") or not message("error converting sid to string"); };
log{ source(s_syslog);f ilter(f_not_auditd); destination(d_logserver); }; log{ source(s_syslog);f ilter(f_not_auditd); destination(d_logserver); };
Misc other things to do
=======================
- It is suggested to bump the audispd queue to adjust for extremely busy systems, for ex. q_depth=512.
- You will also probably need to bump the kernel-side buffer and change the rate limit in audit.rules, for ex. -b 16384
-r 500.
Message handling Message handling
---------------- ----------------