On Tuesday 24 March 2009 14:01:39 LC Bruzenak wrote: > Asked another way, what stops the aggregated audit events from creating > a prelude event?
Prelude grabs things from its own config files to fill in certain fields. This means that if run from an aggregator, it will use the same values for all events. This affects the host names that show up in heartbeats and other events. The two are meant to be separate but complimentary systems. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
