make aide send reports to syslog. make aide logs readable by splunk

playbooks/roles/aide/tasks/main.yml

@@ -10,6 +10,13 @@
     src=etc/default/aide.j2 dest=/etc/default/aide
     owner=root group=root mode=0644
 
+- name: open read permissions on aide logs
+  file: >
+    name="/var/log/aide"
+    recurse="yes"
+    state="directory"
+    mode="755"
+
 - name: aide initial scan (this can take a long time)
   command: >
     aideinit -y -f

playbooks/roles/aide/templates/etc/default/aide.j2

 # These settings are mainly for the wrapper scripts around aide,
 # such as aideinit and /etc/cron.daily/aide
 
+# send reports to syslog
+
+REPORT_URL=syslog:LOG_LOCAL1
+
 # This is used as the host name in the AIDE reports that are sent out
 # via e-mail. It defaults to the output of $(hostname --fqdn), but can
 # be set to arbitrary values.
@@ -11,6 +15,7 @@
 # some variable content here (for example $(date +%Y-%m-%d)).
 MAILSUBJ="Daily AIDE report for $FQDN"
 
+
 # This is the email address reports get mailed to
 # default is root
 # This variable is expanded before it is used, so you can use variables