[PATCH] Add auditd listener and remote audit protocol
Steve Grubb
sgrubb at redhat.com
Fri Aug 15 00:07:02 UTC 2008
On Thursday 14 August 2008 19:50:23 LC Bruzenak wrote:
> I cannot speak for other end-users...but my guess is that if they are
> using audit and aggregating they probably care about not dropping it,
> whereas others can just syslog the events if the auditd isn't enabled
> and then use centralized syslog, right?
Does syslog queue unsent messages and recover them?
-Steve
More information about the Linux-audit
mailing list