On Monday 15 December 2008 02:45:02 am Chu Li wrote: > Recently I used audisp-remote function and I found in audisp-remote.conf > there is "remote_ending_action" parameter. From the manpage, it's the same > with "disk_error_action". But from the codes, its meaning seems to be "the > action taken when the remote audit ends".
Yes. The action options do the same thing. But when its in effect is different. > So I set it as "syslog" and then stopped the remote audit, then the local > audisp-remote stopped but no message about "remote ending". The intention is that it should output something. > I think if "network_retry_time" is reached, whatever the > "fail-safe"(e.g. remote_ending_action) action is set in audisp-remote.conf. > The audisp-remote will exit. Is that true? Could be. I'll play with this more. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
