On Thu, 2008-09-11 at 18:43 -0400, DJ Delorie wrote: > Have you tried killing the client auditd and manually restarting it > (i.e. /etc/rc.d/init.d/auditd restart) ? > > I wonder if there's some catch-22 at system startup, relative to > network startup.
I have, but actually I use : run_init service auditd restart otherwise my audit logs get created at SYSLO which is bad on an MLS system. I have had to restart often because while I am looking for a hint the timeout happens and the audisp-remote process dies. Thx, LCB. -- LC (Lenny) Bruzenak [EMAIL PROTECTED] -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
