I configured on RHEL 8 Server with auditd and rsyslog
/etc/audisp/plugins.d/syslog.conf
active = yes
direction = out
path = builtin_syslog
type = builtin
args = LOG_INFO LOG_LOCAL6
format = string
/etc/rsyslog.conf
local6.* @@QRADAR_CE_SERVER_IP:514
But nothing in Qradar and nothing in listen when I tcpdump
Please helpme with this issue
I checked /var/log/audit/audit.log => it’s still logging
I’ve already created auditd rules
New contributor
Huy Lê is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.