I am trying to configure a CentOS 7 running in VirtualBox to send its audit logs to the host which is FreeBSD 10.3. Ideally, I'd like to receive the logs with FreeBSD's auditdistd(8) but for now I'd just like to be able to use netcat for that.My problem is that netcat doesn't get any data.DetailsWhen I run service auditd status I get the following results:Redirecting to /bin/systemctl status  auditd.serviceauditd.service - Security Auditing Service   Loaded: loaded (/usr/lib/systemd/system/auditd.service; enabled; vendor preset: enabled)   Active: active (running) since Fri 2016-08-19 11:35:42 CEST; 3s ago  Process: 2216 ExecStartPost=/sbin/augenrules --load (code=exited, status=1/FAILURE) Main PID: 2215 (auditd)   CGroup: /system.slice/auditd.service           2215 /sbin/auditd -n           2218 /sbin/audispdAug 19 11:35:42 hephaistos audispd[2218]: plugin /sbin/audisp-remote was restartedAug 19 11:35:42 hephaistos audispd[2218]: plugin /sbin/audisp-remote terminated unexpectedlyAug 19 11:35:42 hephaistos audispd[2218]: plugin /sbin/audisp-remote was restartedAug 19 11:35:42 hephaistos audispd[2218]: plugin /sbin/audisp-remote terminated unexpectedlyAug 19 11:35:42 hephaistos audispd[2218]: plugin /sbin/audisp-remote was restartedAug 19 11:35:42 hephaistos audispd[2218]: plugin /sbin/audisp-remote terminated unexpectedlyAug 19 11:35:42 hephaistos audispd[2218]: plugin /sbin/audisp-remote was restartedAug 19 11:35:42 hephaistos audispd[2218]: plugin /sbin/audisp-remote terminated unexpectedlyAug 19 11:35:42 hephaistos audispd[2218]: plugin /sbin/audisp-remote has exceeded max_restartsAug 19 11:35:42 hephaistos audispd[2218]: plugin /sbin/audisp-remote was restartedSetupNetwork SetupCentOS and FreeBSD are connected on a host-only network. I've assigned them the following IP's:CentOS: 192.168.56.101FreeBSD: 192.168.56.1FreeBSD SetupI've got netcat listening on port 60:nc -lk 60The connection works. I can use nc 192.168.56.1 60 on CentOS to send data to FreeBSD.CentOS SetupThe kernel version is: 4.7.0-1.el7.elrepo.x86_64 #1 SMP Sun Jul 24 18:15:29 EDT 2016 x86_64 x86_64 x86_64 GNU/Linux.The version of Linux Audit userspace is 2.6.6.auditd is running and actively logging to /var/log/audit.log.The auditing rules in /etc/audit/rules.d/ are well configured.The configuration of /etc/audisp/audisp-remote.conf looks like this:remote-server = 192.168.56.1port = 60local_port = anytransport = tcpmode = immediateI've got two default files in /etc/audisp/plugins.d/: syslog.conf and af_unix.conf and both of them are not active. I've added af-remote.conf and it looks like this:# This file controls the audispd data path to the# remote event logger. This plugin will send events to# a remote machine (Central Logger).active = yesdirection = outpath = /sbin/audisp-remotetype = always#args =format = stringIt is a modified example from the official repository (link).Here's the content of /etc/audisp/audispd.conf:q_depth = 150overflow_action = SYSLOGpriority_boost = 4max_restarts = 10name_format = HOSTNAMEI'll be happy to provide more details if needed.
How to send audit logs with audisp-remote and receive them with netcat
centos;logs;freebsd;netcat;linux audit
I am not sure if everything here is needed to succeed. Nevertheless, this is a configuration which works so that I am able to receive Linux Audit logs with a netcat on FreeBSD.CentOS:/etc/audisp/audisp-remote.conf:remote_server = 192.168.56.1port = 60local_port = 60transport = tcpmode = immediatequeue_depth = 200format = managedCentOS:/etc/audisp/plugins.d/au-remote.conf:active = yesdirection = outpath = /sbin/audisp-remotetype = alwaysargs = /etc/audisp/audisp-remote.confformat = stringCentOS:/etc/audit/auditd.conf:local_events = yeslog_file = /var/log/audit/audit.log# Send logs to the server.  Don't save them.write_logs = nolog_format = RAWlog_group = rootpriority_boost = 8num_logs = 5disp_qos = lossydispatcher = /sbin/audispdname_format = hostnamemax_log_file = 6max_log_file_action = ROTATEaction_mail_acct = rootspace_left = 75space_left_action = SYSLOGadmin_space_left = 50admin_space_left_action = SUSPENDdisk_full_action = SUSPENDdisk_error_action = SUSPEND##tcp_listen_port =tcp_listen_queue = 5tcp_max_per_addr = 1use_libwrap = yes##tcp_client_ports = 1024-65535tcp_client_max_idle = 0enable_krb5 = nokrb5_principal = auditd##krb5_key_file = /etc/audit/audit.keydistribute_network = noFreeBSD:/etc/hosts.allow: ALL : ALL : allowI don't know if this one is needed though + it might be a bad idea.That's it. Now you just have to run nc -lk 60 on FreeBSD and service auditd restart on CentOS. In my case however netcat seems to be receiving/printing every record at least two times which seems rather unusual.