Re: [PATCH] Add auditd listener and remote audit protocol

Steve Grubb
2008-08-15T00:07:02Z

On Thursday 14 August 2008 19:50:23 LC Bruzenak wrote:
> I cannot speak for other end-users...but my guess is that if they are
> using audit and aggregating they probably care about not dropping it,
> whereas others can just syslog the events if the auditd isn't enabled
> and then use centralized syslog, right?

Does syslog queue unsent messages and recover them?

-Steve