From mboxrd@z Thu Jan 1 00:00:00 1970 From: LC Bruzenak Subject: Re: audit collector connect fails Date: Thu, 11 Sep 2008 17:53:01 -0500 Message-ID: <1221173581.6559.90.camel@homeserver> References: <1220984797.6596.162.camel@homeserver> <200809091836.m89IatSW011688@greed.delorie.com> <1220986021.6596.167.camel@homeserver> <200809091925.m89JPmTd013185@greed.delorie.com> <1220990608.6596.200.camel@homeserver> <200809092011.m89KBshr014405@greed.delorie.com> <1220997150.6596.217.camel@homeserver> <200809092207.m89M7Dul017709@greed.delorie.com> <1221148112.6559.24.camel@homeserver> <1221170441.6559.85.camel@homeserver> <200809112243.m8BMhWNx008873@greed.delorie.com> Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <200809112243.m8BMhWNx008873@greed.delorie.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: DJ Delorie Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Thu, 2008-09-11 at 18:43 -0400, DJ Delorie wrote: > Have you tried killing the client auditd and manually restarting it > (i.e. /etc/rc.d/init.d/auditd restart) ? > > I wonder if there's some catch-22 at system startup, relative to > network startup. I have, but actually I use : run_init service auditd restart otherwise my audit logs get created at SYSLO which is bad on an MLS system. I have had to restart often because while I am looking for a hint the timeout happens and the audisp-remote process dies. Thx, LCB. -- LC (Lenny) Bruzenak lenny@magitekltd.com