Auditing activated with syslog plugin does not reports the RUID info
Hi,
I've activated the Solaris BSM on Solaris 10.
Audit logs are written into files in /var/audit/
I've also activated the syslog plugin to send audit logs to a remote ip adress: plugin:name=audit_syslog.so; p_flags=lo,ex,fw,fc,fd
All is working fine locally , but it seems that some info sent to through the syslog are missing, such a the SUBJECT line:
<subject audit-uid="john" uid="mike" gid="family" ruid="mike" rgid="family" pid="255" sid="2841387154" tid="11602 131094 gvaunx16.lloydstsb.ch"/>
It seems that the syslog only forward the audit-uid="john", and NOT the ruid="mike".
I need to know the RUID (Real User ID), but there is no such info one the remote server (Where the sylog sends audir logs).
0