Aggregate auditd events

[bosseres]

Hello everyone! 

Do anybody know, is it possible to aggregate (bind) auditd events (I mean logs from audit/audit.log) in one by Record ID (Event ID)? I want to make in on parsing study, and to get in my index already aggregated events in one.

[gcusello]

Hi @bosseres,

usually logs are indexed as they are.

Then you can display them aggregated as you like or detailed for each event.

Could you betetr describe your requirement?

Ciao.

Giuseppe

[bosseres]

you are right, I can aggregate them, but problem that I have many searches where I need make the same one aggregation, it requires a lot of resources

is it any options to aggregate them before searching?

maybe any already ready solutions for auditd logs?

[gcusello]

Hi @bosseres,

my hint is to create a scheduled search that aggregates logs asaving results in a summary index.

Then you can use this aggregated summary index for your searches.

Ciao.

Giuseppe