Re: [PATCH] Add error-handling actions to audisp-remote
One of the options, on network failure, is to suspend logging. At
that point, you can inject the missing records and resume logging with
SIGUSR2. This doesn't synchronize the streams, though, so no
guarantees of missing or duplicating a record.
On another subject, I liked how you are capable of returning error
conditions from the server, and then have an action for each of
those.
Thanks! The definitions for all that are in lib/private.h