Re: [PATCH] Add auditd listener and remote audit protocol
On Thursday 14 August 2008 20:22:24 LC Bruzenak wrote:
I think you have a good point - this is the first cut and maybe later
on
institute a "replay daemon" or something which can send events on
reconnect.
Note that all audispd plugins take their input from stdin. At the worst, if
you had the time hacks, you could
ausearch --start <time> --end <time> --raw | /sbin.audisp-remote
-Steve