Re: [PATCH] Add error-handling actions to audisp-remote
On Monday 15 December 2008 02:45:02 am Chu Li wrote:
Recently I used audisp-remote function and I found in
audisp-remote.conf
there is "remote_ending_action" parameter. From the manpage, it's the same
with "disk_error_action". But from the codes, its meaning seems to be
"the
action taken when the remote audit ends".
Yes. The action options do the same thing. But when its in effect is
different.
So I set it as "syslog" and then stopped the remote audit,
then the local
audisp-remote stopped but no message about "remote ending".
The intention is that it should output something.
I think if "network_retry_time" is reached, whatever the
"fail-safe"(e.g. remote_ending_action) action is set in audisp-remote.conf.
The audisp-remote will exit. Is that true?
Could be. I'll play with this more.
-Steve