[PATCH] Add error-handling actions to audisp-remote

Steve Grubb sgrubb at redhat.com
Tue Dec 23 13:19:06 UTC 2008


On Monday 22 December 2008 03:04:38 pm Steve Grubb wrote:
> > So I set it as "syslog" and then stopped the remote audit, then the local
> > audisp-remote stopped but no message about "remote ending".
>
> The intention is that it should output something.

After further review, it looks like the code that does this on the server side 
is not implemented. The network retries are what you would expect in the face 
of not getting notification that the server was going down. I'll see if we 
can add this in the next release.

-Steve




More information about the Linux-audit mailing list