audit collection

On my F9 machines I still get no events (that I can tell) across. I have changed to sending from / receiving on 64-bit machines only, since that's what I have for now. I have made the "name_format = user", "name = hugo" on the sender in audispd.conf just to be certain it is unique. =================== On the sender I see: messages log (hundreds of these): Sep 15 11:48:14 comms audispd: queue is full - dropping event I assume this indicates the problem - sending isn't happening so the audispd queue fills. I'd have expected an audisp syslog error though. lsof: [root@hugo audit]# lsof | grep sdos audisp-re 5082 root 3u IPv4 92619 TCP comms:41065->dell1:tsdos390 (ESTABLISHED) =================== On the collector I see: [root@dell1 audit]# lsof | grep sdos auditd 5790 root 9u IPv4 34892 TCP *:tsdos390 (LISTEN) auditd 5790 root 10u IPv4 35068 TCP comms:tsdos390->hugo:41065 (ESTABLISHED) and nothing in the messages log. I'm not seeing any of the events in the collector log from the sender (reading the audit.log file directly until Steve's ausearch node= patch is applied). I'm also sending between machines with the same MLS policy in permissive mode. Any ideas? I guess I can go check the code where the send happens to see if there is any debug I can add. Thx, LCB. -- LC (Lenny) Bruzenak lenny(a)magitekltd.com