Hadoop Development - CSC

Real world example - a Cyber problem (cont’d)
• The problem can addressed by processing the audit logs produced by the
auditd daemon that is supplied with Linux kernels 2.6.x (or newer).
• In order to get auditd to log the data we are interested in it is necessary to
set up rules in /etc/audit/audit.rules on each server as specified in the
NSA document
“Guide to the Secure Configuration of Red Hat Enterprise Linux 5, Revision 4,
September 14, 2010”
• The data to process looks something like this:
TBSC 2009
11/10/2011 12:53 PM 0725-23_TBSC 2009 23