From mboxrd@z Thu Jan 1 00:00:00 1970 From: LC Bruzenak Subject: audisp resend question Date: Thu, 04 Dec 2008 11:21:29 -0600 Message-ID: <1228411289.14768.187.camel@homeserver> Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Return-path: Received: from mx3.redhat.com (mx3.redhat.com [172.16.48.32]) by int-mx1.corp.redhat.com (8.13.1/8.13.1) with ESMTP id mB4HLjim003802 for ; Thu, 4 Dec 2008 12:21:45 -0500 Received: from mail.magitekltd.com (rrcs-24-242-137-197.sw.biz.rr.com [24.242.137.197]) by mx3.redhat.com (8.13.8/8.13.8) with ESMTP id mB4HLUGn030353 for ; Thu, 4 Dec 2008 12:21:31 -0500 Received: from [24.242.137.194] (helo=[192.168.30.40]) by mail.magitekltd.com with esmtpsa (TLS-1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.63) (envelope-from ) id 1L8Hrc-00087y-Em for linux-audit@redhat.com; Thu, 04 Dec 2008 11:19:44 -0600 List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Linux Audit List-Id: linux-audit@redhat.com Steve or DJ, Have you guys thought about how I can re-send submitter events from a client to a master auditd after failure? I'm thinking of the case where the aggregating/collector machine has failed and the clients then shut down as configured. Say the problem on the collector is fixed and it comes back up. Then we bring up the client sender machine(s). I haven't tested this but I do not think the missed events will get sent right? How can I try to resend the events to the collector? I apologize if there is a way I've missed. I think it would be possible to write the events to a separate file and resend those on restart. But even if there is a manual/semi-manual way to do this it beats nothing in my case. Thx, LCB. -- LC (Lenny) Bruzenak lenny@magitekltd.com