One of the options, on network failure, is to suspend logging. At that point, you can inject the missing records and resume logging with SIGUSR2. This doesn't synchronize the streams, though, so no guarantees of missing or duplicating a record.
> On another subject, I liked how you are capable of returning error > conditions from the server, and then have an action for each of > those. Thanks! The definitions for all that are in lib/private.h -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
