Estou criando um compartilhamento do nfs. Também configurei auditd para combinar os logs em um servidor centralizado.
Eu configurei o audisp-remote de acordo com as instruções no link: link
Noe quando eu corro tail -f /var/log/audit/audit.log , eu recebo alguns logs que são dados abaixo:
type=SERVICE_STOP msg=audit(1528976466.096:11450): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=mysql comm="systemd" exe="/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_START msg=audit(1528976496.188:11451): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=mysql comm="systemd" exe="/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
type=SERVICE_START msg=audit(1528976496.348:11452): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=mysql comm="systemd" exe="/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_STOP msg=audit(1528976496.348:11453): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=mysql comm="systemd" exe="/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_START msg=audit(1528976526.448:11454): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=mysql comm="systemd" exe="/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
type=SERVICE_START msg=audit(1528976526.596:11455): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=mysql comm="systemd" exe="/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_STOP msg=audit(1528976526.596:11456): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=mysql comm="systemd" exe="/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_START msg=audit(1528976556.704:11457): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=mysql comm="systemd" exe="/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
type=SERVICE_START msg=audit(1528976556.848:11458): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=mysql comm="systemd" exe="/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_STOP msg=audit(1528976556.848:11459): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=mysql comm="systemd" exe="/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Agora, por que o hostname não fornece o nome do host?
Posso obtê-lo de uma forma mais legível?
Por favor me ajude. Obrigado. :)