> I do require centralized auditing and I also require (more importantly) > not losing any.
The key code is in audisp/plugins/remote/audisp-remote.c I think I put a couple of FIXMEs in there where the various errors are noted. If you want to put in a queue and retry mechanism, go ahead :-) > AMQP may be heavyweight, however if you start down the road of trying to > not lose networked audit data you probably end up somewhere near there > anyway... You can always buy more paranoia. -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
