Re: [PATCH] Add auditd listener and remote audit protocol

On Thu, 2008-08-14 at 20:27 -0400, Steve Grubb wrote: > On Thursday 14 August 2008 20:22:24 LC Bruzenak wrote: > > I think you have a good point - this is the first cut and maybe later on > > institute a "replay daemon" or something which can send events on > > reconnect. > > Note that all audispd plugins take their input from stdin. At the worst, if > you had the time hacks, you could > > ausearch --start <time> --end <time> --raw | /sbin.audisp-remote > > -Steve