Re: [PATCH] Add error-handling actions to audisp-remote

Steve Grubb
2008-12-22T20:04:38Z

On Monday 15 December 2008 02:45:02 am Chu Li wrote:
> Recently I used audisp-remote function and I found in audisp-remote.conf
> there is "remote_ending_action" parameter. From the manpage, it's the same
> with "disk_error_action". But from the codes, its meaning seems to be "the
> action taken when the remote audit ends".

Yes. The action options do the same thing. But when its in effect is
different.

> So I set it as "syslog" and then stopped the remote audit, then the local
> audisp-remote stopped but no message about "remote ending".

The intention is that it should output something.

> I think if "network_retry_time" is reached, whatever the
> "fail-safe"(e.g. remote_ending_action) action is set in audisp-remote.conf.
> The audisp-remote will exit. Is that true?

Could be. I'll play with this more.

-Steve