From mboxrd@z Thu Jan 1 00:00:00 1970 From: "MAUPERTUIS, PHILIPPE" Subject: ausearch on the fly Date: Fri, 20 Dec 2019 13:33:11 +0000 Message-ID: <5F4EE10832231F4F921A255C1D9542982304BF@DEERLM99EX7MSX.ww931.my-it-solutions.net> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============5750592539742850326==" Return-path: Received: from mimecast-mx02.redhat.com (mimecast06.extmail.prod.ext.rdu2.redhat.com [10.11.55.22]) by smtp.corp.redhat.com (Postfix) with ESMTPS id B423D2166B29 for ; Fri, 20 Dec 2019 13:33:17 +0000 (UTC) Received: from us-smtp-1.mimecast.com (us-smtp-delivery-1.mimecast.com [207.211.31.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 63D20185B0C2 for ; Fri, 20 Dec 2019 13:33:17 +0000 (UTC) Content-Language: fr-FR List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: "linux-audit@redhat.com" List-Id: linux-audit@redhat.com --===============5750592539742850326== Content-Language: fr-FR Content-Type: multipart/alternative; boundary="_000_5F4EE10832231F4F921A255C1D9542982304BFDEERLM99EX7MSXww9_" --_000_5F4EE10832231F4F921A255C1D9542982304BFDEERLM99EX7MSXww9_ Content-Type: text/plain; charset=WINDOWS-1252 Content-Transfer-Encoding: quoted-printable Hi, We are centralizing the audit logs with rsyslog. The SIEM behind the central log server is unable to process the raw logs. We would like to push the ausearch result in CSV format in real time or ne= ar real time. Is there a way to have ausearch working from a pipe and and waiting when no= logs are received Regards Philippe equensWorldline is a registered trade mark and trading name owned by the Wo= rldline Group through its holding company. This e-mail and the documents attached are confidential and intended solely= for the addressee. If you receive this e-mail in error, you are not author= ized to copy, disclose, use or retain it. Please notify the sender immediat= ely and delete this email from your systems. As emails may be intercepted, = amended or lost, they are not secure. EquensWorldline and the Worldline Gro= up therefore can accept no liability for any errors or their content. Altho= ugh equensWorldline and the Worldline Group endeavours to maintain a virus-= free network, we do not warrant that this transmission is virus-free and ca= n accept no liability for any damages resulting from any virus transmitted.= The risks are deemed to be accepted by everyone who communicates with eque= nsWorldline and the Worldline Group by email --_000_5F4EE10832231F4F921A255C1D9542982304BFDEERLM99EX7MSXww9_ Content-Type: text/html; charset=WINDOWS-1252 Content-Transfer-Encoding: quoted-printable

Hi,

We are centralizing  the a= udit logs with rsyslog.

The SIEM behind the central log= server is unable to process the raw logs.

We would like to push the ausea= rch  result in CSV format in real time or near real time.

Is there a way to have ausearch= working from a pipe and and waiting when no logs are received

 

Regards

Philippe

equensWorldline is a registered trade mark and trading name owned by the= Worldline Group through its holding company.
This e-mail and the documents attached are confidential and intended solely= for the addressee. If you receive this e-mail in error, you are not author= ized to copy, disclose, use or retain it. Please notify the sender immediat= ely and delete this email from your systems. As emails may be intercepted, amended or lost, they are not secur= e. EquensWorldline and the Worldline Group therefore can accept no liabilit= y for any errors or their content. Although equensWorldline and the Worldli= ne Group endeavours to maintain a virus-free network, we do not warrant that this transmission is virus-fr= ee and can accept no liability for any damages resulting from any virus tra= nsmitted. The risks are deemed to be accepted by everyone who communicates = with equensWorldline and the Worldline Group by email

--_000_5F4EE10832231F4F921A255C1D9542982304BFDEERLM99EX7MSXww9_-- --===============5750592539742850326== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============5750592539742850326==-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: ausearch on the fly Date: Fri, 20 Dec 2019 14:23:34 -0500 Message-ID: <1765069.Uqzcf1Iu7r@x2> References: <5F4EE10832231F4F921A255C1D9542982304BF@DEERLM99EX7MSX.ww931.my-it-solutions.net> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <5F4EE10832231F4F921A255C1D9542982304BF@DEERLM99EX7MSX.ww931.my-it-solutions.net> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com Cc: "MAUPERTUIS, PHILIPPE" List-Id: linux-audit@redhat.com On Friday, December 20, 2019 8:33:11 AM EST MAUPERTUIS, PHILIPPE wrote: > We are centralizing the audit logs with rsyslog. > The SIEM behind the central log server is unable to process the raw logs. > We would like to push the ausearch result in CSV format in real time or > near real time. Is there a way to have ausearch working from a pipe and > and waiting when no logs are received I think that I've seen others who setup a cron job and use the checkpointing feature so that they do not miss anything. You can pipe its output into logger. You probably also want to cut the first line which has the column headers. ausearch --start today --checkpoint /root/last-ausearch .chpt --format csv | tail -n +2 | logger Also, the latest syslog plugin can now do interpretation. I think its in alpha-9 which dates back to Nov 04, 2019. It really shouldn't be hard to copy and paste the code from ausearch into the syslog plugin to log directly in that format. I wonder if anyone else would find that useful? -Steve From mboxrd@z Thu Jan 1 00:00:00 1970 From: "MAUPERTUIS, PHILIPPE" Subject: RE: ausearch on the fly Date: Fri, 20 Dec 2019 19:26:08 +0000 Message-ID: <5F4EE10832231F4F921A255C1D954298230A39@DEERLM99EX7MSX.ww931.my-it-solutions.net> References: <5F4EE10832231F4F921A255C1D9542982304BF@DEERLM99EX7MSX.ww931.my-it-solutions.net> <1765069.Uqzcf1Iu7r@x2> Mime-Version: 1.0 Content-Type: text/plain; charset=WINDOWS-1252 Content-Transfer-Encoding: quoted-printable Return-path: Received: from mimecast-mx02.redhat.com (mimecast04.extmail.prod.ext.rdu2.redhat.com [10.11.55.20]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 99D0216C8FA for ; Fri, 20 Dec 2019 19:26:18 +0000 (UTC) Received: from us-smtp-1.mimecast.com (us-smtp-1.mimecast.com [207.211.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id A704E10163DE for ; Fri, 20 Dec 2019 19:26:18 +0000 (UTC) In-Reply-To: <1765069.Uqzcf1Iu7r@x2> Content-Language: fr-FR List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Steve Grubb , "linux-audit@redhat.com" List-Id: linux-audit@redhat.com Thank you steve, I will have a look at it. Philippe -----Message d'origine----- De : Steve Grubb [mailto:sgrubb@redhat.com] Envoy=E9 : vendredi 20 d=E9cembre 2019 20:24 =C0 : linux-audit@redhat.com Cc : MAUPERTUIS, PHILIPPE Objet : Re: ausearch on the fly On Friday, December 20, 2019 8:33:11 AM EST MAUPERTUIS, PHILIPPE wrote: > We are centralizing the audit logs with rsyslog. > The SIEM behind the central log server is unable to process the raw logs. > We would like to push the ausearch result in CSV format in real time or > near real time. Is there a way to have ausearch working from a pipe and > and waiting when no logs are received I think that I've seen others who setup a cron job and use the checkpointin= g feature so that they do not miss anything. You can pipe its output into logger. You probably also want to cut the first line which has the column headers. ausearch --start today --checkpoint /root/last-ausearch .chpt --format csv = | tail -n +2 | logger Also, the latest syslog plugin can now do interpretation. I think its in alpha-9 which dates back to Nov 04, 2019. It really shouldn't be hard to copy and paste the code from ausearch into t= he syslog plugin to log directly in that format. I wonder if anyone else would find that useful? -Steve equensWorldline is a registered trade mark and trading name owned by the Wo= rldline Group through its holding company. This e-mail and the documents attached are confidential and intended solely= for the addressee. If you receive this e-mail in error, you are not author= ized to copy, disclose, use or retain it. Please notify the sender immediat= ely and delete this email from your systems. As emails may be intercepted, = amended or lost, they are not secure. EquensWorldline and the Worldline Gro= up therefore can accept no liability for any errors or their content. Altho= ugh equensWorldline and the Worldline Group endeavours to maintain a virus-= free network, we do not warrant that this transmission is virus-free and ca= n accept no liability for any damages resulting from any virus transmitted.= The risks are deemed to be accepted by everyone who communicates with eque= nsWorldline and the Worldline Group by email From mboxrd@z Thu Jan 1 00:00:00 1970 From: "warron.french" Subject: Re: ausearch on the fly Date: Mon, 23 Dec 2019 20:15:32 -0500 Message-ID: References: <5F4EE10832231F4F921A255C1D9542982304BF@DEERLM99EX7MSX.ww931.my-it-solutions.net> <1765069.Uqzcf1Iu7r@x2> <5F4EE10832231F4F921A255C1D954298230A39@DEERLM99EX7MSX.ww931.my-it-solutions.net> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============2041895325647403013==" Return-path: Received: from mimecast-mx02.redhat.com (mimecast01.extmail.prod.ext.rdu2.redhat.com [10.11.55.17]) by smtp.corp.redhat.com (Postfix) with ESMTPS id DAC512166B29 for ; Tue, 24 Dec 2019 01:15:47 +0000 (UTC) Received: from us-smtp-1.mimecast.com (us-smtp-1.mimecast.com [205.139.110.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id D9B1B85A304 for ; Tue, 24 Dec 2019 01:15:46 +0000 (UTC) In-Reply-To: <5F4EE10832231F4F921A255C1D954298230A39@DEERLM99EX7MSX.ww931.my-it-solutions.net> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: "MAUPERTUIS, PHILIPPE" Cc: "linux-audit@redhat.com" List-Id: linux-audit@redhat.com --===============2041895325647403013== Content-Type: multipart/alternative; boundary="000000000000189e3a059a68e2d5" --000000000000189e3a059a68e2d5 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable I have seen it done in exactly this manner too. Where I work we do this. -------------------------- Warron French On Fri, Dec 20, 2019 at 2:26 PM MAUPERTUIS, PHILIPPE < philippe.maupertuis@equensworldline.com> wrote: > Thank you steve, > I will have a look at it. > Philippe > > -----Message d'origine----- > De : Steve Grubb [mailto:sgrubb@redhat.com] > Envoy=C3=A9 : vendredi 20 d=C3=A9cembre 2019 20:24 > =C3=80 : linux-audit@redhat.com > Cc : MAUPERTUIS, PHILIPPE > Objet : Re: ausearch on the fly > > On Friday, December 20, 2019 8:33:11 AM EST MAUPERTUIS, PHILIPPE wrote: > > We are centralizing the audit logs with rsyslog. > > The SIEM behind the central log server is unable to process the raw log= s. > > We would like to push the ausearch result in CSV format in real time o= r > > near real time. Is there a way to have ausearch working from a pipe and > > and waiting when no logs are received > > I think that I've seen others who setup a cron job and use the > checkpointing > feature so that they do not miss anything. You can pipe its output into > logger. You probably also want to cut the first line which has the column > headers. > > ausearch --start today --checkpoint /root/last-ausearch .chpt --format cs= v > | tail -n +2 | logger > > Also, the latest syslog plugin can now do interpretation. I think its in > alpha-9 which dates back to Nov 04, 2019. > > It really shouldn't be hard to copy and paste the code from ausearch into > the > syslog plugin to log directly in that format. I wonder if anyone else wou= ld > find that useful? > > -Steve > > > equensWorldline is a registered trade mark and trading name owned by the > Worldline Group through its holding company. > This e-mail and the documents attached are confidential and intended > solely for the addressee. If you receive this e-mail in error, you are no= t > authorized to copy, disclose, use or retain it. Please notify the sender > immediately and delete this email from your systems. As emails may be > intercepted, amended or lost, they are not secure. EquensWorldline and th= e > Worldline Group therefore can accept no liability for any errors or their > content. Although equensWorldline and the Worldline Group endeavours to > maintain a virus-free network, we do not warrant that this transmission i= s > virus-free and can accept no liability for any damages resulting from any > virus transmitted. The risks are deemed to be accepted by everyone who > communicates with equensWorldline and the Worldline Group by email > > > -- > Linux-audit mailing list > Linux-audit@redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit > > --000000000000189e3a059a68e2d5 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
I have seen it done in exactly this manner too.=C2=A0 Wher= e I work we do this.

-------= -------------------
Warron French
=


On Fri, Dec 20, 2019 at 2:26 PM MAUPERT= UIS, PHILIPPE <philippe.maupertuis@equensworldline.com> wrote:
Thank you steve,
I will have a look at it.
Philippe

-----Message d'origine-----
De : Steve Grubb [mailto:sgrubb@redhat.com]
Envoy=C3=A9 : vendredi 20 d=C3=A9cembre 2019 20:24
=C3=80 : linux-= audit@redhat.com
Cc : MAUPERTUIS, PHILIPPE
Objet : Re: ausearch on the fly

On Friday, December 20, 2019 8:33:11 AM EST MAUPERTUIS, PHILIPPE wrote:
> We are centralizing=C2=A0 the audit logs with rsyslog.
> The SIEM behind the central log server is unable to process the raw lo= gs.
> We would like to push the ausearch=C2=A0 result in CSV format in real = time or
> near real time. Is there a way to have ausearch working from a pipe an= d
> and waiting when no logs are received

I think that I've seen others who setup a cron job and use the checkpoi= nting
feature so that they do not miss anything. You can pipe its output into
logger. You probably also want to cut the first line which has the column headers.

ausearch --start today --checkpoint /root/last-ausearch .chpt --format csv = | tail -n +2 | logger

Also, the latest syslog plugin can now do interpretation. I think its in alpha-9 which dates back to Nov 04, 2019.

It really shouldn't be hard to copy and paste the code from ausearch in= to the
syslog plugin to log directly in that format. I wonder if anyone else would=
find that useful?

-Steve


equensWorldline is a registered trade mark and trading name owned by the Wo= rldline Group through its holding company.
This e-mail and the documents attached are confidential and intended solely= for the addressee. If you receive this e-mail in error, you are not author= ized to copy, disclose, use or retain it. Please notify the sender immediat= ely and delete this email from your systems. As emails may be intercepted, = amended or lost, they are not secure. EquensWorldline and the Worldline Gro= up therefore can accept no liability for any errors or their content. Altho= ugh equensWorldline and the Worldline Group endeavours to maintain a virus-= free network, we do not warrant that this transmission is virus-free and ca= n accept no liability for any damages resulting from any virus transmitted.= The risks are deemed to be accepted by everyone who communicates with eque= nsWorldline and the Worldline Group by email


--
Linux-audit mailing list
Linux-audit@red= hat.com
https://www.redhat.com/mailman/listinfo/linux-aud= it

--000000000000189e3a059a68e2d5-- --===============2041895325647403013== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============2041895325647403013==-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: "MAUPERTUIS, PHILIPPE" Subject: RE: ausearch on the fly Date: Fri, 7 Feb 2020 08:13:23 +0000 Message-ID: <5F4EE10832231F4F921A255C1D95429829AF30@DEERLM99EX7MSX.ww931.my-it-solutions.net> References: <5F4EE10832231F4F921A255C1D9542982304BF@DEERLM99EX7MSX.ww931.my-it-solutions.net> <1765069.Uqzcf1Iu7r@x2> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mimecast-mx02.redhat.com (mimecast03.extmail.prod.ext.rdu2.redhat.com [10.11.55.19]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 085902166B27 for ; Fri, 7 Feb 2020 08:13:28 +0000 (UTC) Received: from us-smtp-1.mimecast.com (us-smtp-2.mimecast.com [207.211.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id BFEAB803888 for ; Fri, 7 Feb 2020 08:13:28 +0000 (UTC) In-Reply-To: <1765069.Uqzcf1Iu7r@x2> Content-Language: fr-FR List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Steve Grubb , "linux-audit@redhat.com" List-Id: linux-audit@redhat.com > On Friday, December 20, 2019 8:33:11 AM EST MAUPERTUIS, PHILIPPE wrote: > > We are centralizing the audit logs with rsyslog. > > The SIEM behind the central log server is unable to process the raw logs. > > We would like to push the ausearch result in CSV format in real time or > > near real time. Is there a way to have ausearch working from a pipe and > > and waiting when no logs are received > > I think that I've seen others who setup a cron job and use the checkpointing > feature so that they do not miss anything. You can pipe its output into > logger. You probably also want to cut the first line which has the column > headers. > > ausearch --start today --checkpoint /root/last-ausearch .chpt --format csv | > tail -n +2 | logger On a central log server the input file can grow very big and very fast. Probably logrotate is needed to keep it in check. What happen to the checkpointing feature when the file is rotated ? How not to miss the last events from the old file and get the new events from the new file ? > > Also, the latest syslog plugin can now do interpretation. I think its in > alpha-9 which dates back to Nov 04, 2019. > > It really shouldn't be hard to copy and paste the code from ausearch into the > syslog plugin to log directly in that format. I wonder if anyone else would > find that useful? > It would be very useful indeed Philippe equensWorldline is a registered trade mark and trading name owned by the Worldline Group through its holding company. This e-mail and the documents attached are confidential and intended solely for the addressee. If you receive this e-mail in error, you are not authorized to copy, disclose, use or retain it. Please notify the sender immediately and delete this email from your systems. As emails may be intercepted, amended or lost, they are not secure. EquensWorldline and the Worldline Group therefore can accept no liability for any errors or their content. Although equensWorldline and the Worldline Group endeavours to maintain a virus-free network, we do not warrant that this transmission is virus-free and can accept no liability for any damages resulting from any virus transmitted. The risks are deemed to be accepted by everyone who communicates with equensWorldline and the Worldline Group by email From mboxrd@z Thu Jan 1 00:00:00 1970 From: Burn Alting Subject: Re: ausearch on the fly Date: Fri, 07 Feb 2020 22:49:18 +1100 Message-ID: <7ad9a4ee6fe595d5688d15a3acee1c3ad1872188.camel@iinet.net.au> References: <5F4EE10832231F4F921A255C1D9542982304BF@DEERLM99EX7MSX.ww931.my-it-solutions.net> <1765069.Uqzcf1Iu7r@x2> <5F4EE10832231F4F921A255C1D95429829AF30@DEERLM99EX7MSX.ww931.my-it-solutions.net> Reply-To: burn@swtf.dyndns.org Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============0157177692574228274==" Return-path: Received: from mimecast-mx02.redhat.com (mimecast03.extmail.prod.ext.rdu2.redhat.com [10.11.55.19]) by smtp.corp.redhat.com (Postfix) with ESMTPS id BCB4B2166B27 for ; Fri, 7 Feb 2020 11:49:26 +0000 (UTC) Received: from us-smtp-1.mimecast.com (us-smtp-2.mimecast.com [205.139.110.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 73A8B803ADE for ; Fri, 7 Feb 2020 11:49:26 +0000 (UTC) In-Reply-To: <5F4EE10832231F4F921A255C1D95429829AF30@DEERLM99EX7MSX.ww931.my-it-solutions.net> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: "MAUPERTUIS, PHILIPPE" , Steve Grubb , "linux-audit@redhat.com" List-Id: linux-audit@redhat.com --===============0157177692574228274== Content-Type: multipart/alternative; boundary="=-ldIilp0Md3+p4f2xBpdO" --=-ldIilp0Md3+p4f2xBpdO Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Philippe, On Fri, 2020-02-07 at 08:13 +0000, MAUPERTUIS, PHILIPPE wrote: > > On Friday, December 20, 2019 8:33:11 AM EST MAUPERTUIS, PHILIPPE wrote: > > > We are centralizing the audit logs with rsyslog.The SIEM behind the = central > > > log server is unable to process the raw logs.We would like to push th= e > > > ausearch result in CSV format in real time ornear real time. Is ther= e a way > > > to have ausearch working from a pipe andand waiting when no logs are = received > >=20 > > I think that I've seen others who setup a cron job and use the > > checkpointingfeature so that they do not miss anything. You can pipe it= s output > > intologger. You probably also want to cut the first line which has the > > columnheaders. > > ausearch --start today --checkpoint /root/last-ausearch .chpt --format = csv |tail > > -n +2 | logger >=20 > On a central log server the input file can grow very big and very fast.Pr= obably > logrotate is needed to keep it in check.What happen to the checkpointing = feature > when the file is rotated ?How not to miss the last events from the old fi= le and > get the new events from the new file ? The above performs a checkpoint on the local machine and then sends it's ou= tput to the local syslog service via the logger program. Ausearchis independent of = the syslog service. The checkpoint function of ausearch takes into account the = audit.log log file roll-over feature built into auditd so,providing your auditd log f= ile rotation is set appropriately, checkpoint works no matter how many audit.lo= g files are in the audit log directory.For information, a 9 file 32MB per log file configuration works well for a very heavy processing host where exec's are = logged. Further, if the generation of logsis such that the checkpoint does miss log= s, then the checkpoint documentation shows one how to address this. If this is note= d, then include the size of or numberof local log files.=20 > > Also, the latest syslog plugin can now do interpretation. I think its i= nalpha-9 > > which dates back to Nov 04, 2019. > > It really shouldn't be hard to copy and paste the code from ausearch in= to > > thesyslog plugin to log directly in that format. I wonder if anyone els= e > > wouldfind that useful? >=20 >=20 > --Linux-audit mailing listLinux-audit@redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit >=20 --=-ldIilp0Md3+p4f2xBpdO Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Philippe,

On Fri, 2020-02-07 at 08:13 +00= 00, MAUPERTUIS, PHILIPPE wrote:

On Friday, December 20, 2019 8:33:11 AM=
 EST MAUPERTUIS, PHILIPPE wrote:

<= /pre>
We are centralizing  the audit logs with rsyslog.
The S=
IEM behind the central log server is unable to process the raw logs.
<= pre>We would like to push the ausearch result in CSV format in real time o= r
near real time. Is there a way to have ausearch working from a =
pipe and
and waiting when no logs are received
=


I think that I've seen others who setup =
a cron job and use the checkpointing
feature so that they do not =
miss anything. You can pipe its output into
logger. You probably =
also want to cut the first line which has the column
headers.

ausearch --start today --checkpoint /root/last-ausear=
ch .chpt --format csv |
tail -n +2 | logger

On a central log server the input file can grow very big a=
nd very fast.
Probably logrotate is needed to keep it in check.
What happen to the checkpointing feature when the file is rotated =
?
How not to miss the last events from the old file and get the n=
ew events from the new file ?

The abo= ve performs a checkpoint on the local machine and then sends it's output to= the local syslog service via the logger program. Ausearch
is ind= ependent of the syslog service. The checkpoint function of ausearch takes i= nto account the audit.log log file roll-over feature built into auditd so,<= /div>
providing your auditd log file rotation is set appropriately, che= ckpoint works no matter how many audit.log files are in the audit log direc= tory.
For information, a 9 file 32MB per log file configuration w= orks well for a very heavy processing host where exec's are logged. Further= , if the generation of logs
is such that the checkpoint does miss= logs, then the checkpoint documentation shows one how to address this. If = this is noted, then include the size of or number
of local log fi= les.

<= /pre>

Also, the latest syslog plugin can now do interpre=
tation. I think its in
alpha-9 which dates back to Nov 04, 2019.<=
/pre>

It really shouldn't be hard to copy and paste the =
code from ausearch into the
syslog plugin to log directly in that=
 format. I wonder if anyone else would
find that useful?




=
--
Linux-audit mailing list
Linux-audit@redhat.com

https://www.redhat.=
com/mailman/listinfo/linux-audit


--=-ldIilp0Md3+p4f2xBpdO-- --===============0157177692574228274== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============0157177692574228274==-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: "MAUPERTUIS, PHILIPPE" Subject: Re: ausearch on the fly Date: Fri, 7 Feb 2020 12:44:12 +0000 Message-ID: References: <5F4EE10832231F4F921A255C1D9542982304BF@DEERLM99EX7MSX.ww931.my-it-solutions.net> <1765069.Uqzcf1Iu7r@x2> <5F4EE10832231F4F921A255C1D95429829AF30@DEERLM99EX7MSX.ww931.my-it-solutions.net>, <7ad9a4ee6fe595d5688d15a3acee1c3ad1872188.camel@iinet.net.au> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============1337296996115723336==" Return-path: Received: from mimecast-mx02.redhat.com (mimecast03.extmail.prod.ext.rdu2.redhat.com [10.11.55.19]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 0DCBAB9767 for ; Fri, 7 Feb 2020 12:44:18 +0000 (UTC) Received: from us-smtp-1.mimecast.com (us-smtp-2.mimecast.com [207.211.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 2E42580387E for ; Fri, 7 Feb 2020 12:44:18 +0000 (UTC) In-Reply-To: <7ad9a4ee6fe595d5688d15a3acee1c3ad1872188.camel@iinet.net.au> Content-Language: en-US List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Burn Alting , Steve Grubb , "linux-audit@redhat.com" List-Id: linux-audit@redhat.com --===============1337296996115723336== Content-Language: en-US Content-Type: multipart/alternative; boundary="_000_uoevvso2qbma3lpo7nmskg991581079142127emaillgecom_" --_000_uoevvso2qbma3lpo7nmskg991581079142127emaillgecom_ Content-Type: text/plain; charset=WINDOWS-1252 Content-Transfer-Encoding: quoted-printable Hi, I should have been more precise in my question. I want to run this ausearch on the central log server, not on the original = server. Very likely i need to specify the input file in that. And this input file would need to be rotated outside auditd Philippe Envoy=E9 depuis mon mobile Orange ------ Message d'origine------ De: Burn Alting Date: ven. 7 f=E9vr. 2020 12:49 =C0: MAUPERTUIS, PHILIPPE;Steve Grubb;linux-audit@redhat.com; Cc: Objet :Re: ausearch on the fly Philippe, On Fri, 2020-02-07 at 08:13 +0000, MAUPERTUIS, PHILIPPE wrote: On Friday, December 20, 2019 8:33:11 AM EST MAUPERTUIS, PHILIPPE wrote: We are centralizing the audit logs with rsyslog. The SIEM behind the central log server is unable to process the raw logs. We would like to push the ausearch result in CSV format in real time or near real time. Is there a way to have ausearch working from a pipe and and waiting when no logs are received I think that I've seen others who setup a cron job and use the checkpointin= g feature so that they do not miss anything. You can pipe its output into logger. You probably also want to cut the first line which has the column headers. ausearch --start today --checkpoint /root/last-ausearch .chpt --format csv = | tail -n +2 | logger On a central log server the input file can grow very big and very fast. Probably logrotate is needed to keep it in check. What happen to the checkpointing feature when the file is rotated ? How not to miss the last events from the old file and get the new events fr= om the new file ? The above performs a checkpoint on the local machine and then sends it's ou= tput to the local syslog service via the logger program. Ausearch is independent of the syslog service. The checkpoint function of ausearch t= akes into account the audit.log log file roll-over feature built into audit= d so, providing your auditd log file rotation is set appropriately, checkpoint wo= rks no matter how many audit.log files are in the audit log directory. For information, a 9 file 32MB per log file configuration works well for a = very heavy processing host where exec's are logged. Further, if the generat= ion of logs is such that the checkpoint does miss logs, then the checkpoint documentati= on shows one how to address this. If this is noted, then include the size o= f or number of local log files. Also, the latest syslog plugin can now do interpretation. I think its in alpha-9 which dates back to Nov 04, 2019. It really shouldn't be hard to copy and paste the code from ausearch into t= he syslog plugin to log directly in that format. I wonder if anyone else would find that useful? -- Linux-audit mailing list Linux-audit@redhat.com https://www.redhat.com/mailman/listinfo/linux-audit equensWorldline is a registered trade mark and trading name owned by the Wo= rldline Group through its holding company. This e-mail and the documents attached are confidential and intended solely= for the addressee. If you receive this e-mail in error, you are not author= ized to copy, disclose, use or retain it. Please notify the sender immediat= ely and delete this email from your systems. As emails may be intercepted, = amended or lost, they are not secure. EquensWorldline and the Worldline Gro= up therefore can accept no liability for any errors or their content. Altho= ugh equensWorldline and the Worldline Group endeavours to maintain a virus-= free network, we do not warrant that this transmission is virus-free and ca= n accept no liability for any damages resulting from any virus transmitted.= The risks are deemed to be accepted by everyone who communicates with eque= nsWorldline and the Worldline Group by email --_000_uoevvso2qbma3lpo7nmskg991581079142127emaillgecom_ Content-Type: text/html; charset=WINDOWS-1252 Content-Transfer-Encoding: quoted-printable
Hi,
I should have been more precise in my question.
I want to run this ausearch on the central log server, no= t on the original server. 
Very likely i need to specify the input file in that.
And this input file would need to be rotated outside audi= td
Philippe

Envoy=E9 depuis mon mobile Orange

------ Message d'origine------
De: Burn Alting
Date: ven. 7 f=E9vr. 2020 12:49
=C0: MAUPERTUIS, PHILIPPE;Steve Grubb;linux-audit@= redhat.com;
Cc:
Objet :Re: ausearch on the fly

Philippe,

On Fri, 2020-02-07 at 08:13 +0000, MAUPERTUIS, PHILIPPE wrote:

On Friday, December 20, 2019 8:33:11 AM EST MAUPERTUIS, PHILIPPE wrote=
:

We are centralizing  the audit logs with rsyslog.
The SIEM behind the central log server is unable to process the raw lo=
gs.
We would like to push the ausearch  result in CSV format in real time =
or
near real time. Is there a way to have ausearch working from a pipe an=
d
and waiting when no logs are received


I think that I've seen others who setup a cron job and use the checkpo=
inting
feature so that they do not miss anything. You can pipe its output int=
o
logger. You probably also want to cut the first line which has the col=
umn
headers.

ausearch --start today --checkpoint /root/last-ausearch .chpt --format=
 csv |
tail -n +2 | logger

On a central log server the input file can grow very big and very fast=
.
Probably logrotate is needed to keep it in check.
What happen to the checkpointing feature when the file is rotated ?
How not to miss the last events from the old file and get the new even=
ts from the new file ?

The above performs a checkpoint on the local machine and then sends it= 's output to the local syslog service via the logger program. Ausearch
is independent of the syslog service. The checkpoint function of ausea= rch takes into account the audit.log log file roll-over feature built into = auditd so,
providing your auditd log file rotation is set appropriately, checkpoi= nt works no matter how many audit.log files are in the audit log directory.=
For information, a 9 file 32MB per log file configuration works well f= or a very heavy processing host where exec's are logged. Further, if the ge= neration of logs
is such that the checkpoint does miss logs, then the checkpoint docume= ntation shows one how to address this. If this is noted, then include the s= ize of or number
of local log files.


Also, the latest syslog plugin can now do interpretation. I think its =
in
alpha-9 which dates back to Nov 04, 2019.

It really shouldn't be hard to copy and paste the code from ausearch i=
nto the
syslog plugin to log directly in that format. I wonder if anyone else =
would
find that useful?




--
Linux-audit mailing list
Linux-audit@redhat.com

https://www.redhat.com/mailman/listinfo/linux-audit


equensWorldline is a registered trade mark and trading name owned by the= Worldline Group through its holding company.
This e-mail and the documents attached are confidential and intended solely= for the addressee. If you receive this e-mail in error, you are not author= ized to copy, disclose, use or retain it. Please notify the sender immediat= ely and delete this email from your systems. As emails may be intercepted, amended or lost, they are not secur= e. EquensWorldline and the Worldline Group therefore can accept no liabilit= y for any errors or their content. Although equensWorldline and the Worldli= ne Group endeavours to maintain a virus-free network, we do not warrant that this transmission is virus-fr= ee and can accept no liability for any damages resulting from any virus tra= nsmitted. The risks are deemed to be accepted by everyone who communicates = with equensWorldline and the Worldline Group by email

--_000_uoevvso2qbma3lpo7nmskg991581079142127emaillgecom_-- --===============1337296996115723336== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============1337296996115723336==-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Burn Alting Subject: Re: ausearch on the fly Date: Sat, 08 Feb 2020 11:39:19 +1100 Message-ID: References: <5F4EE10832231F4F921A255C1D9542982304BF@DEERLM99EX7MSX.ww931.my-it-solutions.net> <1765069.Uqzcf1Iu7r@x2> <5F4EE10832231F4F921A255C1D95429829AF30@DEERLM99EX7MSX.ww931.my-it-solutions.net> ,<7ad9a4ee6fe595d5688d15a3acee1c3ad1872188.camel@iinet.net.au> Reply-To: burn@swtf.dyndns.org Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============9157362118173939068==" Return-path: Received: from mimecast-mx02.redhat.com (mimecast02.extmail.prod.ext.rdu2.redhat.com [10.11.55.18]) by smtp.corp.redhat.com (Postfix) with ESMTPS id BE560205EB04 for ; Sat, 8 Feb 2020 00:39:27 +0000 (UTC) Received: from us-smtp-1.mimecast.com (us-smtp-1.mimecast.com [205.139.110.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id B73EB802064 for ; Sat, 8 Feb 2020 00:39:27 +0000 (UTC) In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: "MAUPERTUIS, PHILIPPE" , Steve Grubb , "linux-audit@redhat.com" List-Id: linux-audit@redhat.com --===============9157362118173939068== Content-Type: multipart/alternative; boundary="=-El/FbgDwRBjo//aVSPCh" --=-El/FbgDwRBjo//aVSPCh Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Phillipe, To close this off, yes, you will need to investigate making use of the --in= put option. You may also want to consider having a central syslog directory structure that = allows you to simulate the local directory structure (/var/log/audit) by having a revolving set of audit.log, audit.log.1, etc files and age them= off to your raw archive once you have processed them. My preference is to enrich the logs via ausearch on the local host as this = mitigates a number of risks (lost logs as per this discussion, local uids) and then send the results to a central log management capability.=20 Regards Burn On Fri, 2020-02-07 at 12:44 +0000, MAUPERTUIS, PHILIPPE wrote: > Hi, > I should have been more precise in my question. > I want to run this ausearch on the central log server, not on the origina= l > server.=20 > Very likely i need to specify the input file in that. > And this input file would need to be rotated outside auditd > Philippe >=20 >=20 >=20 >=20 > Envoy=C3=A9 depuis mon mobile Orange >=20 >=20 >=20 >=20 >=20 Snip --=-El/FbgDwRBjo//aVSPCh Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Phillipe,
To close this off, yes, you will need to investigate making us= e of the --input option.  You
may also want to consider havi= ng a central syslog directory structure that allows you to simulate the loc= al directory structure (/var/log/audit)
by having a revolving set= of audit.log, audit.log.1, etc files and age them off to your raw archive = once you have processed them.

My preference is to = enrich the logs via ausearch on the local host as this mitigates a number o= f risks (lost logs as per this discussion, local uids)
and then s= end the results to a central log management capability.

Regards
Burn

On Fri, 2020-02-07 a= t 12:44 +0000, MAUPERTUIS, PHILIPPE wrote:
Hi,
I should have been more precise in my question.
I want to run this ausearch on the central log server, no= t on the original server. 
Very likely i need to specify the input file in that.
And this input file would need to be rotated outside audi= td
Philippe

Envoy=C3=A9 depuis mon mobile Orange


Snip --=-El/FbgDwRBjo//aVSPCh-- --===============9157362118173939068== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============9157362118173939068==-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: "MAUPERTUIS, PHILIPPE" Subject: RE: ausearch on the fly Date: Mon, 10 Feb 2020 13:08:59 +0000 Message-ID: <5F4EE10832231F4F921A255C1D95429829D5DC@DEERLM99EX7MSX.ww931.my-it-solutions.net> References: <5F4EE10832231F4F921A255C1D9542982304BF@DEERLM99EX7MSX.ww931.my-it-solutions.net> <1765069.Uqzcf1Iu7r@x2> <5F4EE10832231F4F921A255C1D95429829AF30@DEERLM99EX7MSX.ww931.my-it-solutions.net> ,<7ad9a4ee6fe595d5688d15a3acee1c3ad1872188.camel@iinet.net.au> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============9075893117034677378==" Return-path: Received: from mimecast-mx02.redhat.com (mimecast05.extmail.prod.ext.rdu2.redhat.com [10.11.55.21]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 7476E1C66A for ; Mon, 10 Feb 2020 13:09:17 +0000 (UTC) Received: from us-smtp-1.mimecast.com (us-smtp-2.mimecast.com [205.139.110.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 41A4890085A for ; Mon, 10 Feb 2020 13:09:17 +0000 (UTC) In-Reply-To: Content-Language: fr-FR List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: "burn@swtf.dyndns.org" , Steve Grubb , "linux-audit@redhat.com" List-Id: linux-audit@redhat.com --===============9075893117034677378== Content-Language: fr-FR Content-Type: multipart/alternative; boundary="_000_5F4EE10832231F4F921A255C1D95429829D5DCDEERLM99EX7MSXww9_" --_000_5F4EE10832231F4F921A255C1D95429829D5DCDEERLM99EX7MSXww9_ Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: base64 SGksDQpJIHNob3VsZCBoYXZlIHJlYWQgdGhlIG1hbiBtb3JlIGNhcmVmdWxseS4NCkkgbWlzc2Vk IHRoZSBwb2ludCB0aGF0IC0taW5wdXQgY2FuIGJlIGEgZGlyZWN0b3J5IGFuZCBub3Qgb25seSBh IHNpbmdsZSBmaWxlIGFzIEkgd3JvbmdseSBhc3N1bWVkLg0KVGhhdCBzb2x2ZXMgYW55IHByb2Js ZW1zIEkgaGFkLg0KDQpQaGlsaXBwZQ0KDQpEZSA6IEJ1cm4gQWx0aW5nIFttYWlsdG86YnVybi5h bHRpbmdAaWluZXQubmV0LmF1XQ0KRW52b3nDqSA6IHNhbWVkaSA4IGbDqXZyaWVyIDIwMjAgMDE6 MzkNCsOAIDogTUFVUEVSVFVJUywgUEhJTElQUEU7IFN0ZXZlIEdydWJiOyBsaW51eC1hdWRpdEBy ZWRoYXQuY29tDQpPYmpldCA6IFJlOiBhdXNlYXJjaCBvbiB0aGUgZmx5DQoNClBoaWxsaXBlLA0K DQpUbyBjbG9zZSB0aGlzIG9mZiwgeWVzLCB5b3Ugd2lsbCBuZWVkIHRvIGludmVzdGlnYXRlIG1h a2luZyB1c2Ugb2YgdGhlIC0taW5wdXQgb3B0aW9uLiAgWW91DQptYXkgYWxzbyB3YW50IHRvIGNv bnNpZGVyIGhhdmluZyBhIGNlbnRyYWwgc3lzbG9nIGRpcmVjdG9yeSBzdHJ1Y3R1cmUgdGhhdCBh bGxvd3MgeW91IHRvIHNpbXVsYXRlIHRoZSBsb2NhbCBkaXJlY3Rvcnkgc3RydWN0dXJlICgvdmFy L2xvZy9hdWRpdCkNCmJ5IGhhdmluZyBhIHJldm9sdmluZyBzZXQgb2YgYXVkaXQubG9nLCBhdWRp dC5sb2cuMSwgZXRjIGZpbGVzIGFuZCBhZ2UgdGhlbSBvZmYgdG8geW91ciByYXcgYXJjaGl2ZSBv bmNlIHlvdSBoYXZlIHByb2Nlc3NlZCB0aGVtLg0KDQpNeSBwcmVmZXJlbmNlIGlzIHRvIGVucmlj aCB0aGUgbG9ncyB2aWEgYXVzZWFyY2ggb24gdGhlIGxvY2FsIGhvc3QgYXMgdGhpcyBtaXRpZ2F0 ZXMgYSBudW1iZXIgb2Ygcmlza3MgKGxvc3QgbG9ncyBhcyBwZXIgdGhpcyBkaXNjdXNzaW9uLCBs b2NhbCB1aWRzKQ0KYW5kIHRoZW4gc2VuZCB0aGUgcmVzdWx0cyB0byBhIGNlbnRyYWwgbG9nIG1h bmFnZW1lbnQgY2FwYWJpbGl0eS4NCg0KUmVnYXJkcw0KQnVybg0KDQpPbiBGcmksIDIwMjAtMDIt MDcgYXQgMTI6NDQgKzAwMDAsIE1BVVBFUlRVSVMsIFBISUxJUFBFIHdyb3RlOg0KSGksDQpJIHNo b3VsZCBoYXZlIGJlZW4gbW9yZSBwcmVjaXNlIGluIG15IHF1ZXN0aW9uLg0KSSB3YW50IHRvIHJ1 biB0aGlzIGF1c2VhcmNoIG9uIHRoZSBjZW50cmFsIGxvZyBzZXJ2ZXIsIG5vdCBvbiB0aGUgb3Jp Z2luYWwgc2VydmVyLg0KVmVyeSBsaWtlbHkgaSBuZWVkIHRvIHNwZWNpZnkgdGhlIGlucHV0IGZp bGUgaW4gdGhhdC4NCkFuZCB0aGlzIGlucHV0IGZpbGUgd291bGQgbmVlZCB0byBiZSByb3RhdGVk IG91dHNpZGUgYXVkaXRkDQpQaGlsaXBwZQ0KDQpFbnZvecOpIGRlcHVpcyBtb24gbW9iaWxlIE9y YW5nZQ0KDQoNClNuaXANCg0KZXF1ZW5zV29ybGRsaW5lIGlzIGEgcmVnaXN0ZXJlZCB0cmFkZSBt YXJrIGFuZCB0cmFkaW5nIG5hbWUgb3duZWQgYnkgdGhlIFdvcmxkbGluZSBHcm91cCB0aHJvdWdo IGl0cyBob2xkaW5nIGNvbXBhbnkuDQpUaGlzIGUtbWFpbCBhbmQgdGhlIGRvY3VtZW50cyBhdHRh Y2hlZCBhcmUgY29uZmlkZW50aWFsIGFuZCBpbnRlbmRlZCBzb2xlbHkgZm9yIHRoZSBhZGRyZXNz ZWUuIElmIHlvdSByZWNlaXZlIHRoaXMgZS1tYWlsIGluIGVycm9yLCB5b3UgYXJlIG5vdCBhdXRo b3JpemVkIHRvIGNvcHksIGRpc2Nsb3NlLCB1c2Ugb3IgcmV0YWluIGl0LiBQbGVhc2Ugbm90aWZ5 IHRoZSBzZW5kZXIgaW1tZWRpYXRlbHkgYW5kIGRlbGV0ZSB0aGlzIGVtYWlsIGZyb20geW91ciBz eXN0ZW1zLiBBcyBlbWFpbHMgbWF5IGJlIGludGVyY2VwdGVkLCBhbWVuZGVkIG9yIGxvc3QsIHRo ZXkgYXJlIG5vdCBzZWN1cmUuIEVxdWVuc1dvcmxkbGluZSBhbmQgdGhlIFdvcmxkbGluZSBHcm91 cCB0aGVyZWZvcmUgY2FuIGFjY2VwdCBubyBsaWFiaWxpdHkgZm9yIGFueSBlcnJvcnMgb3IgdGhl aXIgY29udGVudC4gQWx0aG91Z2ggZXF1ZW5zV29ybGRsaW5lIGFuZCB0aGUgV29ybGRsaW5lIEdy b3VwIGVuZGVhdm91cnMgdG8gbWFpbnRhaW4gYSB2aXJ1cy1mcmVlIG5ldHdvcmssIHdlIGRvIG5v dCB3YXJyYW50IHRoYXQgdGhpcyB0cmFuc21pc3Npb24gaXMgdmlydXMtZnJlZSBhbmQgY2FuIGFj Y2VwdCBubyBsaWFiaWxpdHkgZm9yIGFueSBkYW1hZ2VzIHJlc3VsdGluZyBmcm9tIGFueSB2aXJ1 cyB0cmFuc21pdHRlZC4gVGhlIHJpc2tzIGFyZSBkZWVtZWQgdG8gYmUgYWNjZXB0ZWQgYnkgZXZl cnlvbmUgd2hvIGNvbW11bmljYXRlcyB3aXRoIGVxdWVuc1dvcmxkbGluZSBhbmQgdGhlIFdvcmxk bGluZSBHcm91cCBieSBlbWFpbA0K --_000_5F4EE10832231F4F921A255C1D95429829D5DCDEERLM99EX7MSXww9_ Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTQgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJ e2ZvbnQtZmFtaWx5OlRhaG9tYTsNCglwYW5vc2UtMToyIDExIDYgNCAzIDUgNCA0IDIgNDt9DQov KiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1z b05vcm1hbA0KCXttYXJnaW46MGNtOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNp emU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLCJzZXJpZiI7fQ0KYTps aW5rLCBzcGFuLk1zb0h5cGVybGluaw0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6 Ymx1ZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29I eXBlcmxpbmtGb2xsb3dlZA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxl Ow0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTcNCgl7bXNv LXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLCJzYW5z LXNlcmlmIjsNCgljb2xvcjojMUY0OTdEO30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10 eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24x DQoJe3NpemU6NjEyLjBwdCA3OTIuMHB0Ow0KCW1hcmdpbjo3MC44NXB0IDcwLjg1cHQgNzAuODVw dCA3MC44NXB0O30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLS0+ PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9 ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBt c28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0 PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0K PC9oZWFkPg0KPGJvZHkgbGFuZz0iRlIiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRp diBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9 IkVOLVVTIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDs7Y29sb3I6IzFGNDk3RCI+SGksPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssJnF1 b3Q7c2Fucy1zZXJpZiZxdW90Oztjb2xvcjojMUY0OTdEIj5JIHNob3VsZCBoYXZlIHJlYWQgdGhl IG1hbiBtb3JlIGNhcmVmdWxseS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7O2NvbG9yOiMx RjQ5N0QiPkkgbWlzc2VkIHRoZSBwb2ludCB0aGF0IC0taW5wdXQgY2FuIGJlIGEgZGlyZWN0b3J5 IGFuZCBub3Qgb25seSBhIHNpbmdsZSBmaWxlIGFzIEkgd3JvbmdseSBhc3N1bWVkLjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LCZx dW90O3NhbnMtc2VyaWYmcXVvdDs7Y29sb3I6IzFGNDk3RCI+VGhhdCBzb2x2ZXMgYW55IHByb2Js ZW1zIEkgaGFkLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDs7Y29sb3I6IzFGNDk3RCI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFu Zz0iRU4tVVMiIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90Oztjb2xvcjojMUY0OTdEIj5QaGlsaXBwZTxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVO LVVTIiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDs7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286 cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6 c29saWQgI0I1QzRERiAxLjBwdDtwYWRkaW5nOjMuMHB0IDBjbSAwY20gMGNtIj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O1RhaG9tYSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7Ij5EZSZuYnNwOzo8L3Nw YW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1Rh aG9tYSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7Ij4gQnVybiBBbHRpbmcgW21haWx0bzpi dXJuLmFsdGluZ0BpaW5ldC5uZXQuYXVdDQo8YnI+DQo8Yj5FbnZvecOpJm5ic3A7OjwvYj4gc2Ft ZWRpIDggZsOpdnJpZXIgMjAyMCAwMTozOTxicj4NCjxiPsOAJm5ic3A7OjwvYj4gTUFVUEVSVFVJ UywgUEhJTElQUEU7IFN0ZXZlIEdydWJiOyBsaW51eC1hdWRpdEByZWRoYXQuY29tPGJyPg0KPGI+ T2JqZXQmbmJzcDs6PC9iPiBSZTogYXVzZWFyY2ggb24gdGhlIGZseTxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5QaGlsbGlwZSw8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VG8gY2xvc2UgdGhp cyBvZmYsIHllcywgeW91IHdpbGwgbmVlZCB0byBpbnZlc3RpZ2F0ZSBtYWtpbmcgdXNlIG9mIHRo ZSAtLWlucHV0IG9wdGlvbi4mbmJzcDsgWW91PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5tYXkgYWxzbyB3YW50IHRvIGNvbnNpZGVyIGhhdmluZyBh IGNlbnRyYWwgc3lzbG9nIGRpcmVjdG9yeSBzdHJ1Y3R1cmUgdGhhdCBhbGxvd3MgeW91IHRvIHNp bXVsYXRlIHRoZSBsb2NhbCBkaXJlY3Rvcnkgc3RydWN0dXJlICgvdmFyL2xvZy9hdWRpdCk8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPmJ5IGhhdmlu ZyBhIHJldm9sdmluZyBzZXQgb2YgYXVkaXQubG9nLCBhdWRpdC5sb2cuMSwgZXRjIGZpbGVzIGFu ZCBhZ2UgdGhlbSBvZmYgdG8geW91ciByYXcgYXJjaGl2ZSBvbmNlIHlvdSBoYXZlIHByb2Nlc3Nl ZCB0aGVtLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5NeSBwcmVmZXJlbmNlIGlzIHRvIGVucmljaCB0aGUgbG9ncyB2aWEgYXVzZWFyY2ggb24g dGhlIGxvY2FsIGhvc3QgYXMgdGhpcyBtaXRpZ2F0ZXMgYSBudW1iZXIgb2Ygcmlza3MgKGxvc3Qg bG9ncyBhcyBwZXIgdGhpcyBkaXNjdXNzaW9uLCBsb2NhbCB1aWRzKTxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+YW5kIHRoZW4gc2VuZCB0aGUgcmVz dWx0cyB0byBhIGNlbnRyYWwgbG9nIG1hbmFnZW1lbnQgY2FwYWJpbGl0eS4NCjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5SZWdhcmRzPG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5CdXJuPG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uIEZyaSwg MjAyMC0wMi0wNyBhdCAxMjo0NCAmIzQzOzAwMDAsIE1BVVBFUlRVSVMsIFBISUxJUFBFIHdyb3Rl OjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7 Ym9yZGVyLWxlZnQ6c29saWQgIzcyOUZDRiAxLjVwdDtwYWRkaW5nOjBjbSAwY20gMGNtIDYuMHB0 O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi1yaWdodDowY20iPg0KPGRpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdCI+SGksPG86cD48 L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQiPkkgc2hvdWxkIGhhdmUgYmVlbiBtb3JlIHByZWNp c2UgaW4gbXkgcXVlc3Rpb24uPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQiPkkgd2Fu dCB0byBydW4gdGhpcyBhdXNlYXJjaCBvbiB0aGUgY2VudHJhbCBsb2cgc2VydmVyLCBub3Qgb24g dGhlIG9yaWdpbmFsIHNlcnZlci4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBw dCI+VmVyeSBsaWtlbHkgaSBuZWVkIHRvIHNwZWNpZnkgdGhlIGlucHV0IGZpbGUgaW4gdGhhdC48 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdCI+QW5kIHRoaXMgaW5wdXQgZmlsZSB3b3Vs ZCBuZWVkIHRvIGJlIHJvdGF0ZWQgb3V0c2lkZSBhdWRpdGQ8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjEwLjBwdCI+UGhpbGlwcGU8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdCI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxpPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0Ij5FbnZvecOpIGRl cHVpcyBtb24gbW9iaWxlIE9yYW5nZTwvc3Bhbj48L2k+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MC4wcHQiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxk aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MC4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Js b2NrcXVvdGU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5TbmlwPG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHA+ZXF1ZW5zV29ybGRsaW5lIGlzIGEgcmVnaXN0ZXJlZCB0 cmFkZSBtYXJrIGFuZCB0cmFkaW5nIG5hbWUgb3duZWQgYnkgdGhlIFdvcmxkbGluZSBHcm91cCB0 aHJvdWdoIGl0cyBob2xkaW5nIGNvbXBhbnkuPGJyPg0KVGhpcyBlLW1haWwgYW5kIHRoZSBkb2N1 bWVudHMgYXR0YWNoZWQgYXJlIGNvbmZpZGVudGlhbCBhbmQgaW50ZW5kZWQgc29sZWx5IGZvciB0 aGUgYWRkcmVzc2VlLiBJZiB5b3UgcmVjZWl2ZSB0aGlzIGUtbWFpbCBpbiBlcnJvciwgeW91IGFy ZSBub3QgYXV0aG9yaXplZCB0byBjb3B5LCBkaXNjbG9zZSwgdXNlIG9yIHJldGFpbiBpdC4gUGxl YXNlIG5vdGlmeSB0aGUgc2VuZGVyIGltbWVkaWF0ZWx5IGFuZCBkZWxldGUgdGhpcyBlbWFpbCBm cm9tIHlvdXINCiBzeXN0ZW1zLiBBcyBlbWFpbHMgbWF5IGJlIGludGVyY2VwdGVkLCBhbWVuZGVk IG9yIGxvc3QsIHRoZXkgYXJlIG5vdCBzZWN1cmUuIEVxdWVuc1dvcmxkbGluZSBhbmQgdGhlIFdv cmxkbGluZSBHcm91cCB0aGVyZWZvcmUgY2FuIGFjY2VwdCBubyBsaWFiaWxpdHkgZm9yIGFueSBl cnJvcnMgb3IgdGhlaXIgY29udGVudC4gQWx0aG91Z2ggZXF1ZW5zV29ybGRsaW5lIGFuZCB0aGUg V29ybGRsaW5lIEdyb3VwIGVuZGVhdm91cnMgdG8gbWFpbnRhaW4NCiBhIHZpcnVzLWZyZWUgbmV0 d29yaywgd2UgZG8gbm90IHdhcnJhbnQgdGhhdCB0aGlzIHRyYW5zbWlzc2lvbiBpcyB2aXJ1cy1m cmVlIGFuZCBjYW4gYWNjZXB0IG5vIGxpYWJpbGl0eSBmb3IgYW55IGRhbWFnZXMgcmVzdWx0aW5n IGZyb20gYW55IHZpcnVzIHRyYW5zbWl0dGVkLiBUaGUgcmlza3MgYXJlIGRlZW1lZCB0byBiZSBh Y2NlcHRlZCBieSBldmVyeW9uZSB3aG8gY29tbXVuaWNhdGVzIHdpdGggZXF1ZW5zV29ybGRsaW5l IGFuZCB0aGUgV29ybGRsaW5lDQogR3JvdXAgYnkgZW1haWw8YnI+DQo8L3A+DQo8L2JvZHk+DQo8 L2h0bWw+DQo= --_000_5F4EE10832231F4F921A255C1D95429829D5DCDEERLM99EX7MSXww9_-- --===============9075893117034677378== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============9075893117034677378==--