On Thursday 04 December 2008 09:57:54 Loredan Stancu wrote: > Now I'll have to user  audisp-remote plugin to centralize events. One further refinement to what I said yesterday about remote logging. You probably want to set the local_port value to something < 1024 in the remote configuration files. Then in the aggregating auditd, set the tcp_client_ports to the same thing. This is a security feature to prevent random user space apps from trying audit log injection attacks. For experimenting or casual use you don't need to set these up, but for production use you must. If you use kerberos authentication, then you have even more protection. But setting up kerberos for this is a little more than I want to explain. -Steve