How to monitor audit/audispd killed

Steve Grubb sgrubb at redhat.com
Tue Jan 5 14:10:55 UTC 2016


On Tuesday, January 05, 2016 06:08:54 PM Matthew Chao wrote:
> >"You can watch audispd, but I don't think that will help anything.
> 
> my program totally depends on audispd to dispatch audit messages. I think
> audispd need more robust mechanisms to monitor itself killed, otherwise
> which inevitably leads to that audispd' plugins receive nothing but always
> wait wait wait for event messages.
> 
> So are there some alternative ways to monitor audispd killed in audit
> ver1.8 ?

To help you, I need to know more about what the actual problem is that you are 
trying to solve. Would you like to explain the problem so we can help figure 
out how to address it?

Thanks,
-Steve




More information about the Linux-audit mailing list