Re: libauparse: read audit events continously?
Hi Steve,
On 08/10/2025 19:31, Steve Grubb wrote:
That's where auditd places it so that the plugin can always find
it. But in
your case, the af_unix plugin is probably your answer.
Yes exactly; using "socat - UNIX-CONNECT:/var/run/audispd_events" does
the trick.
Thanks for your time.
Regards.