On Thursday 04 December 2008 12:21:29 LC Bruzenak wrote: > Say the problem on the collector is fixed and it comes back up. > Then we bring up the client sender machine(s). > I haven't tested this but I do not think the missed events will get sent > right?
Correct. > How can I try to resend the events to the collector? All audisp plugins take their data from stdin. You can pipe the raw output of ausearch into audisp-remote and it should do the right thing. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
