event loss with dispatcher?

Klaus Heinrich Kiwi klausk at br.ibm.com
Mon Jan 7 13:21:30 UTC 2008


On Thu, 08 Nov 2007 11:54:16 -0500, Klaus Heinrich Kiwi wrote:

> Hi,
> 
>  I'm trying to debug a potential problem with the dispatcher mechanism
> in version 1.6.2. Long story short, I saw that some records were being
> missed in the remote system (using the audisp-racf plugin), couldn't
> find anything wrong with the code, so I enabled the syslog plugin,
> trying to match the the syslog with the audit log output - At least in
> my system, they are not matching.
...

Looks like this was fixed in 1.6.4

 -Klaus K.





More information about the Linux-audit mailing list