[Users] auditd on openvz container

[Keith O'Brien]

Hello,

I am trying to see if it is possible to run auditd inside of a openvz
container. I was able to get it up and running the hardware node, but there
are only a couple of instances that I would like to run audits on so
running it on the hardware node is a good option for me.

I'm also open to a different auditing package that would work inside of a
container. The main goal is to track all root commands,  secondary would be
to  look for changes to /etc/*.

Thanks,
Keith.

DETAILS:
-----------------------
Host Node:
lsbdistdescription => Debian GNU/Linux 7.4 (wheezy)
...
ii  linux-image-2.6.32-openvz-amd64     042stab084.26                 amd64
       ...
ii  linux-image-openvz-amd64            042+1                         amd64
       OpenVZ Linux kernel (meta-package)
ii  vzctl                               4.6-1                         amd64
       server virtualization solution - control tools
ii  vzdump                              1.2.6-3                       all
       OpenVZ backup scripts
ii  vzquota                             3.1-2                         amd64
       server virtualization solution - quota tools

Container:
Debian GNU/Linux 7.4 (wheezy)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openvz.org/pipermail/users/attachments/20140317/e967ca5b/attachment.html>