On Friday 12 September 2008 21:40:23 LC Bruzenak wrote: > > Locally generated events won't have the node= (at least, on my machine > > they don't). Remotely generated events should have the node= on them. > > I thought there was a distinction as to where it was assigned, as in > auditd.conf vice audispd.conf.
Yes. For remote logging the one in audispd.conf is used. I'll be unifying things sometime in the next few months. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
