Hi,

Apart the man pages, I didn’t find anything useful relating to audisp-remote.
I am searching information on how it scales ? Is there any performance issue ?
How to use it in a large environment ? ….

Most of what I found dated a long time ago and mainly said use rsyslog instead.

It seems that centralizing the messages through rsyslog is far more popular.

Is audisp-remote really used ?

The man page read :

       tcp_max_per_addr

              This  is  a  numeric  value  which  indicates  how many concurrent connections from one IP address is allowed.  The

              default is 1 and the maximum is 1024. Setting this too large may allow for a Denial of Service attack on  the  log‐

              ging  server.  Also  note  that the kernel has an internal maximum that will eventually prevent this even if auditd

              allows it by config. The default should be adequate in most cases unless a custom written recovery script  runs  to

              forward unsent events. In this case you would increase the number only large enough to let it in too.

Where could I find an example of recovery script ?

Could it be a way to inject the audit message in auditd after having receiving them via rsyslog ?

This might be useful just because, by default ausearch in all available logs and the –if parameter accepts only one file.

 

 

Maybe my lack of knowledge about auditd leads me to write rubbish.

If so, please direct me to where I can find how to manage and use audit logs after centralizing them.

Not only keeping them but  acutually using them.

 

Philippe