[prev in list] [next in list] [prev in thread] [next in thread] 

List:       selinux
Subject:    Re: setroubleshooter/sealert on central loghost?
From:       Jan-Frode Myklebust <janfrode () tanso ! net>
Date:       2007-08-05 20:57:35
Message-ID: slrnfbcedv.43r.mykleb () lc4eb8045376502 ! ibm ! com
[Download RAW message or body]

On 2007-08-02, Daniel J Walsh <dwalsh@redhat.com> wrote:

> If you keep the logs separate you can use sealert on the log files.
>
> sealert -a logfile

This kind of works if I add a "type=AVC" to the syslogged lines, 
but sealert doesn't show the hostname of the host that sent the
AVC. Any ideas for how to get the "Host Name" field in the sealert
browser to show the hostname ? What's the format sealert expects it
on ? 

If I can find the format, I can probably have syslog-ng insert
it into the log entries.


  -jf


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
[prev in list] [next in list] [prev in thread] [next in thread]