[PATCH] Add error-handling actions to audisp-remote

[Steve Grubb]

On Monday 15 December 2008 02:45:02 am Chu Li wrote:
> Recently I used audisp-remote function and I found in audisp-remote.conf
> there is "remote_ending_action" parameter. From the manpage, it's the same
> with "disk_error_action". But from the codes, its meaning seems to be "the
> action taken  when the remote audit ends".

Yes. The action options do the same thing. But when its in effect is 
different.


> So I set it as "syslog" and then stopped the remote audit, then the local
> audisp-remote stopped but no message about "remote ending". 

The intention is that it should output something.


> I think  if "network_retry_time" is reached, whatever the 
> "fail-safe"(e.g. remote_ending_action) action is set in audisp-remote.conf.
> The audisp-remote will exit. Is that true?

Could be. I'll play with this more.

-Steve