Re: [PATCH] Add auditd listener and remote audit protocol
I do require centralized auditing and I also require (more
importantly)
not losing any.
The key code is in audisp/plugins/remote/audisp-remote.c
I think I put a couple of FIXMEs in there where the various errors are
noted. If you want to put in a queue and retry mechanism, go ahead :-)
AMQP may be heavyweight, however if you start down the road of trying
to
not lose networked audit data you probably end up somewhere near there
anyway...
You can always buy more paranoia.