From mboxrd@z Thu Jan  1 00:00:00 1970
From: DJ Delorie <dj@redhat.com>
Subject: Re: [PATCH] Add error-handling actions to audisp-remote
Date: Fri, 29 Aug 2008 15:50:50 -0400
Message-ID: <200808291950.m7TJoouc032071@greed.delorie.com>
References: <200808281847.m7SIlbHs001641@greed.delorie.com>
	<1220038858.6673.60.camel@klausk.br.ibm.com>
Return-path: <linux-audit-bounces@redhat.com>
In-reply-to: <1220038858.6673.60.camel@klausk.br.ibm.com> (message from Klaus
	Heinrich Kiwi on Fri, 29 Aug 2008 16:40:58 -0300)
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: Klaus Heinrich Kiwi <klausk@linux.vnet.ibm.com>
Cc: linux-audit@redhat.com
List-Id: linux-audit@redhat.com


One of the options, on network failure, is to suspend logging.  At
that point, you can inject the missing records and resume logging with
SIGUSR2.  This doesn't synchronize the streams, though, so no
guarantees of missing or duplicating a record.

> On another subject, I liked how you are capable of returning error
> conditions from the server, and then have an action for each of
> those.

Thanks!  The definitions for all that are in lib/private.h