Hi
I'm setting up forwarders for a number of Linux systems. I will be monitoring user login/authentication and audits to those servers. At first I was logging logs from /var/log/secure and /var/log/messages. Now I was thinking of using the nix app with enabling the following inputs instead of during my recent setup.
The following is the list of inputs I will be enabling.
Will the information of the inputs suffice our case? Just want to know if also anyone have a same setup.
Id still monitor /var/log/secure and /var/log/messages too but put them in a separate index. Then compare your indexes after a while and see if they both contain what you're looking for. If they each have a little of something you're looking for, keep your current setup and the new unix/linux add on's inputs as well.
Cheers,
JKat54