On Tue, Oct 4, 2016 at 10:10 AM, leam hall <leamhall@gmail.com> wrote:

For /etc/audisp/plugins.d/syslog.conf, is "LOG_WARN" an accpeted arg, or does it need to be "LOG_WARNING"?

You must use real facility names as documented in syslog(3), so: LOG_WARNING.