[PATCH] Add error-handling actions to audisp-remote
Steve Grubb
sgrubb at redhat.com
Tue Dec 23 13:19:06 UTC 2008
On Monday 22 December 2008 03:04:38 pm Steve Grubb wrote:
> > So I set it as "syslog" and then stopped the remote audit, then the local
> > audisp-remote stopped but no message about "remote ending".
>
> The intention is that it should output something.
After further review, it looks like the code that does this on the server side
is not implemented. The network retries are what you would expect in the face
of not getting notification that the server was going down. I'll see if we
can add this in the next release.
-Steve
More information about the Linux-audit
mailing list