2.7.1 Understanding Audit Zones with an Example

The following diagram illustrates where the audit details are stored when there are two zones. Location 1 and Location 2 are configured as two different zones. Zone 1 includes Agents and modules (like Audit Manager) and Zone 2 is where the target machine (SSH) is hosted and the target machine does not include PAM agent. Let us understand, how the audits are managed in the following scenarios:

  • Host with Agents

    In Zone 1, agents and manager send audit data to the Audit Manager (location1-pam-audit-manager-1) of same zone. Similarly, agents and manager of Zone 2 log audit data in the respective Audit Manager (location2-pam-audit-manager-1).

  • Host without Agents

    From Zone 1, when a user tries to access SSH machine that is hosted on Zone 2 via the SSH proxy (location1-pam-manager-1), then the audits of each action is recorded on PAM Manager of Zone 1 (location1-pam-manager-1) and it will transferred to Audit Manager of Zone 1.