Hello,
the attached patch series implements the store-and-forward mode in audisp-remote.

In mode=forward, as audisp-remote receives audit records, it automatically writes them to a local file.  Therefore neither an unexpected termination of audisp-remote nor problems with the remote server can cause loss of the audit records, and audisp-remote will try to resend all of the pending records before sending any later received audit record, or after restarting audisp-remote.  (Note that loss of audit records is still possible in other cases, e.g. when the system crashes before the records are received by audisp-remote, or when the local queue file is corrupted.)

Detailed description of the approach is included in the individual patches.
    Mirek