Setup: F10 machines sending to a F10 collector with audisp-remote plugin.
On my sending machines, I have the "network_failure_action = halt" set. I also left the default time settings for retries. In testing, if I restart the auditd on the collectors the senders shut down immediately. Is this expected behavior, and if so, what time parameters might allow the senders to survive a auditd restart on the collector machine? Thx, LCB. -- LC (Lenny) Bruzenak [email protected] -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
