Re: Help with auditd.conf

Tony Jones
2008-04-29T19:01:33Z

It's not possibly directly. The kernel will log to syslog if there is no
auditd running but normally, with auditd running it'll log to auditd but
what you are trying to achieve is the reason the displatcher (audispd) was
created. If you don't want to use one of the existing modules, you could
easily create your own which just relays to the local syslog.

Tony