evenup / evenup-auditd Goto Github PK

Great work you guys have done here, when should we expect a Forge release?

Thanks
Rob

Tue Jan 13 10:53:33 +0100 2015 /Stage[main]/Auditd::Install/Package[audit]/ensure (notice): created
Tue Jan 13 10:53:34 +0100 2015 /Stage[main]/Auditd::Config/File[/etc/audit/auditd.conf]/content (notice): content changed '{md5}e1886162554c18906df2ecd258aa4794' to '{md5}2e7b2f91045d9b25b2e950023c77063e'
Tue Jan 13 10:53:34 +0100 2015 /Stage[main]/Auditd::Config/File[/etc/audit/auditd.conf]/mode (notice): mode changed '0640' to '0440'
Tue Jan 13 10:53:34 +0100 2015 Puppet (err): Could not set 'file' on ensure: No such file or directory - /etc/audit/rules.d/audit.rules20150113-8859-1maytaf.lock at 28:/etc/puppet/modules/auditd/manifests/config.pp
Tue Jan 13 10:53:34 +0100 2015 Puppet (err): Could not set 'file' on ensure: No such file or directory - /etc/audit/rules.d/audit.rules20150113-8859-1maytaf.lock at 28:/etc/puppet/modules/auditd/manifests/config.pp
Wrapped exception:
No such file or directory - /etc/audit/rules.d/audit.rules20150113-8859-1maytaf.lock
Tue Jan 13 10:53:34 +0100 2015 /Stage[main]/Auditd::Config/File[/etc/audit/rules.d/audit.rules]/ensure (err): change from absent to file failed: Could not set 'file' on ensure: No such file or directory - /etc/audit/rules.d/audit.rules20150113-8859-1maytaf.lock at 28:/etc/puppet/modules/auditd/manifests/config.pp
Tue Jan 13 10:53:34 +0100 2015 /Stage[main]/Auditd::Service/Serviceauditd: Dependency File[/etc/audit/rules.d/audit.rules] has failures: true
Tue Jan 13 10:53:34 +0100 2015 /Stage[main]/Auditd::Service/Serviceauditd: Skipping because of failed dependencies
Tue Jan 13 10:53:34 +0100 2015 /Stage[main]/Auditd::Service/Serviceauditd: Triggered 'refresh' from 1 events
Tue Jan 13 10:53:34 +0100 2015 /Stage[main]/Auditd/Anchorauditd::end: Dependency File[/etc/audit/rules.d/audit.rules] has failures: true
Tue Jan 13 10:53:34 +0100 2015 /Stage[main]/Auditd/Anchorauditd::end: Skipping because of failed dependencies

I'd very much like to take advantage of my existing centralized syslog setup to archive off my audit logs should the host "have issues" that require a trustworthy audit.

http://wiki.rsyslog.com/index.php/Centralizing_the_audit_log#native_auditd_syslogging