Running multiple audit service clients

[Steve Grubb]

On Thursday, February 11, 2016 03:19:27 PM Max Timchenko wrote:
> I have read the docs on audispd(8) - is it something auditd and the other
> client could use to enable multiple access? It sounds like audispd does
> support multiple clients, but I would guess all clients would have to use
> the audispd plugin interface instead of the usual kernel API.

Yes. This is intentional and has existed for about 10 years.


> What is missing from the documentation for me is the relationship between
> audispd and auditd - whether audispd is an optional component of auditd that
> can run concurrently

Yes. If you look in auditd.conf, you will see that there is a configuration 
option, dispatcher, which allows you to select another consumer of audit 
events. Normally the selection of /sbin/audispd is the best because it allows 
"unlimited" multiplexing of the audit stream.

You can send events to syslog, setroubleshoot, and remotely log events in an 
aggregator all at the same time.


> , or audispd is a replacement of auditd when configured
> (and then auditd cannot run on the same machine
> without running into the same multi-client issues).

No. The audispd man page says, "audispd is an audit event multiplexor. It has 
to be started by the audit daemon in order to get events."

HTH...

-Steve