I'm setting up a central server using rsyslog and auditd on CentOS 8. I was following this guide on how to send remote audit logs to my central server.
Note: instead of going to /etc/audisp/, these files can be found on /etc/audit/ instead.
So I had these Following configurations on both servers
Client:
/etc/audit/auditd.conf
log_format = ENRICHED
name_format = HOSTNAME
/etc/audit/plugins.d/au-remote.conf
active = yes
/etc/audit/audisp-remote.conf
remote_server = <remote server IP>
port = 60
Central server:
/etc/audit/auditd
tcp_listen_port = 60
Firewall:
60/tcp
I have restarted both auditd services on both servers but I got this errors: error messages
Anything wrong? Or does making audit immutable affect this?