Create auditd formula
According to linked prod's we need to create fully functional
auditd formula. This formula allows install and configure auditd, as
well as generate auditd rules and install/configure audisp
plugins if necessary.
Change-Id: Ieb6c889c7fceec7281e1ad019b1f07daf689c3f7
Related-PROD: https://mirantis.jira.com/browse/PROD-20233
Related-PROD: https://mirantis.jira.com/browse/PROD-20138
diff --git a/tests/pillar/rules.sls b/tests/pillar/rules.sls
new file mode 100644
index 0000000..2e4bb0d
--- /dev/null
+++ b/tests/pillar/rules.sls
@@ -0,0 +1,35 @@
+auditd:
+ service:
+ enabled: true
+ log_file: /var/log/audit/audit.log
+ log_format: RAW
+ log_group: root
+ priority_boost: 4
+ flush: INCREMENTAL
+ freq: 20
+ num_logs: 5
+ disp_qos: lossy
+ dispatcher: /sbin/audispd
+ name_format: NONE
+ max_log_file: 6
+ max_log_file_action: ROTATE
+ space_left: 75
+ space_left_action: SYSLOG
+ action_mail_acct: root
+ admin_space_left: 50
+ admin_space_left_action: SUSPEND
+ disk_full_action: SUSPEND
+ disk_error_action: SUSPEND
+ tcp_listen_queue: 5
+ tcp_max_per_addr: 1
+ tcp_client_max_idle: 0
+ enable_krb5: no
+ rules:
+ options:
+ enabled: 0
+ bufzise: 4096
+ rules:
+ host_conf:
+ enabled: true
+ rule_list:
+ - '-w /etc/host.conf -p wa'