>> I would like to speak to those people who use it reliably in production! >> Specifically, do they have heartbeats configured? > >Hello Ken, been fielding systems for a very long time now. > >Yes. I've always had heartbeats configured on.
Thank you for your reply! So I am wondering ... - Did you ever try without heartbeats configured on? - Do you see the same things that I see, in that if there is a connection drop you don't get a connection retry unless you don't get an audit event within the heartbeat interval? - What _do_ you have your heartbeat interval set to? I settled on 120 seconds basically as a guess and that seems to work based on the amount of audit activity we get (it is bursty enough that so far we've always had a idle interval of at least 120 seconds). Thanks for any feedback you can give me! --Ken -- Linux-audit mailing list [email protected] https://listman.redhat.com/mailman/listinfo/linux-audit
