[PATCH] Add error-handling actions to audisp-remote

DJ Delorie dj at redhat.com
Fri Aug 29 19:50:50 UTC 2008


One of the options, on network failure, is to suspend logging.  At
that point, you can inject the missing records and resume logging with
SIGUSR2.  This doesn't synchronize the streams, though, so no
guarantees of missing or duplicating a record.

> On another subject, I liked how you are capable of returning error
> conditions from the server, and then have an action for each of
> those.

Thanks!  The definitions for all that are in lib/private.h




More information about the Linux-audit mailing list