Audit Dispatcher Design

[Steve Grubb]

On Tuesday 06 September 2005 14:45, Timothy R. Chavez wrote:
> Just a note:
>
> AFAIK the OpenDocument Presentation (ODP) file format is not supported in
> OpenOffice 1.0/1.  For a list of applications that do support this file
> format (including OpenOffice 2) check here,

Right. I forgot to mention that. I am on a FC4 machine at this point. It has 
all the utilities to read the material. I'll mention that on the web page.

> > The audit dispatcher will be configured by a file /etc/audisp.conf that
> > will instruct it on how to configure the input plugins and the output
> > filter plugin. Some plugins will be active - meaning that they have their
> > own thread of execution. Others will be passive and use the caller's
> > thread.
>
> Will auditd require audisp be running

No.

> or will the absence of audisp produce a default behavior in auditd?

With or without audisp, auditd behavior is not changed. That was one of the 
design goals in the requirements I sent to the mail list 2 weeks ago.

> I think it might be useful to spend 30m/1hr on the phone / IRC going over
> these diagrams for all parties interested (*raises hand*).  This would be
> more helpful for me, at least.

Too much to explain for IRC. The text is a basic narration for the slides. I 
can go over it next time we speak. Or f there's a lot of demand, maybe a 20 
minute telecon could be set up.

-Steve