Setup: F10 machines sending to a F10 collector with audisp-remote plugin. On my sending machines, I have the "network_failure_action = halt" set. I also left the default time settings for retries. In testing, if I restart the auditd on the collectors the senders shut down immediately. Is this expected behavior, and if so, what time parameters might allow the senders to survive a auditd restart on the collector machine? Thx, LCB. -- LC (Lenny) Bruzenak lenny(a)magitekltd.com