Re: audisp resend question
On Thursday 04 December 2008 12:21:29 LC Bruzenak wrote:
Say the problem on the collector is fixed and it comes back up.
Then we bring up the client sender machine(s).
I haven't tested this but I do not think the missed events will get sent
right?
Correct.
How can I try to resend the events to the collector?
All audisp plugins take their data from stdin. You can pipe the raw output of
ausearch into audisp-remote and it should do the right thing.
-Steve