Re: [PATCH] Add auditd listener and remote audit protocol

DJ Delorie
2008-08-15T00:23:52Z

> I do require centralized auditing and I also require (more importantly)
> not losing any.

The key code is in audisp/plugins/remote/audisp-remote.c

I think I put a couple of FIXMEs in there where the various errors are
noted. If you want to put in a queue and retry mechanism, go ahead :-)

> AMQP may be heavyweight, however if you start down the road of trying to
> not lose networked audit data you probably end up somewhere near there
> anyway...

You can always buy more paranoia.