I worked through a situation awhile back and wanted to send a quick post to the list describing how i solved it in case anyone else may be needing help.<br><br>The issue i cam across was that several of my customer boxes stopped logging to my consolidated audit server via audisp-remote.  I received messages in the local /var/log/messages files for these servers stating that the network connection to my log server had been broken and that audisp-remote was terminating.  Obviously, i need audisp-remote to not terminate when it cant find the log server and to keep attempting to re-connect(while spooling events locally, see &#39;q_depth&#39;).<br>
<br>The corrective action i took that resolved my issue was to adjust two parameters in the /etc/audisp/audisp-remote.conf config file:<br><br>I modified the following parameters:<br><br>network_failure_action = stop<br>remote_ending_action = suspend<br>
<br>and changed them to:<br><br>network_failure_action = ignore<br>
remote_ending_action = reconnect<br><br>and now all of my customer boxes are reporting without stoppage, even when the network or log server is temporarily unavailable.  I imagine the local audit buffer will fill up on the client side though if your network or log server is unavailable for any extended period of time.<br>
<br>Just though i would share in case anyone needs help with this.<br><br>-Nick Nachefski<br>