Re: [PATCH] Add auditd listener and remote audit protocol

Steve Grubb
2008-08-15T00:27:40Z

On Thursday 14 August 2008 20:22:24 LC Bruzenak wrote:
> I think you have a good point - this is the first cut and maybe later on
> institute a "replay daemon" or something which can send events on
> reconnect.

Note that all audispd plugins take their input from stdin. At the worst, if
you had the time hacks, you could

ausearch --start --end --raw | /sbin.audisp-remote

-Steve