diff --git a/README.md b/README.md index edf8dde..9362c9d 100644 --- a/README.md +++ b/README.md @@ -61,6 +61,9 @@ rules: - -a exit,always -F arch=b32 -S execve ``` +##### Running as a service + +Check the `contrib` folder, it contains examples for how to run `go-audit` as a proper service on your machine. ## FAQ diff --git a/contrib/upstart.go-audit.conf b/contrib/upstart.go-audit.conf new file mode 100644 index 0000000..8182e5b --- /dev/null +++ b/contrib/upstart.go-audit.conf @@ -0,0 +1,21 @@ +description "go-audit server" + +start on runlevel [2345] +stop on runlevel [!2345] + +respawn +respawn limit 10 5 + +script + # Catch any output from stdout/stderr and forward to syslog + rm -f "/tmp/go-audit.log" + mkfifo "/tmp/go-audit.log" + (setsid logger -t"go-audit" <"/tmp/go-audit.log" &) + exec >"/tmp/go-audit.log" 2>"/tmp/go-audit.log" + rm "/tmp/go-audit.log" + + # There can be only one auditd + /etc/init.d/auditd stop + + exec /usr/local/bin/go-audit +end script