How to collect audit.log without disabling SELinux in RSA NetWitness Logs & Network 10.x and above

Issue

Need to collect the /var/log/audit/audit.log logs on a specific Red Hat Linux system without disabling the SELinux under /etc/selinux/config file.

Resolution

1. Write audit logs to /var/log/messages
   With the default configuration, rsyslog will not send the audit logs to any syslog server. Configure audit logs to write on /var/log/messages by editing /etc/audisp/plugins.d/syslog.conf
   1. Change active = yes
   2. Add LOG_LOCAL6 in args
   
    
2. Set rule in /etc/rsyslog.conf to route the logs to Netwitness Log Collector or remote collectors. <
   Add the following:
   #audit log
   $ModLoad imfile
   $InputFileName /var/log/audit/audit.log
   $InputFileTag tag_audit_log:
   $InputFileStateFile audit_log
   $InputFileSeverity info
   $InputFileFacility local6
   $InputRunFileMonitor
   :
   #Log Forwarding to RSA Netwitness
   *.* @@ :514
   
   
   /li>
3. Restart auditd and rsyslog services as follows:
   [root@ldecoder3 ~]# service auditd restart
   Stopping auditd: [ OK ]
   Starting auditd: [ OK ]
   [root@ldecoder3 ~]# service rsyslog restart
   Shutting down system logger: [ OK ]
   Starting system logger: [ OK ]
   Once completed, go to Investigation > Navigate and you should see the audit logs on NetWitness console
   
   
    

Product Details

Summary

Collect /var/log/audit/audit.log through existing syslog channel without changing the SELinux ‘enforcing’ mode.

Approval Reviewer Queue

RSA NetWitness Suite Approval Queue