Re: Changing Syslog facility

Steve Grubb
2014-09-19T15:39:12Z

On Friday, September 19, 2014 04:14:44 PM Marcus Inskip wrote:
> I’m trying to change the logging facility of audispd to local2 to send logs
> off to a remote server via Rsyslog without logging twice is this possible?

The audisp-syslog plugin should do it. Just open
/etc/audisp/plugins.d/syslog.conf and add LOCAL2 to the args line. Then enable
the module and restart the audit daemon.

-Steve

--
Linux-audit mailing list
Linux-audit@redhat.com