Configure audispd's Plugin network_failure_action On Network Failure

Description

Configure the action the operating system takes if there is an error sending audit records to a remote system. Edit the file /etc/audit/audisp-remote.conf. Add or modify the following line, substituting ACTION appropriately:

network_failure_action = ACTION

Set this value to single to cause the system to switch to single user mode for corrective action. Acceptable values also include syslog and halt. For certain systems, the need for availability outweighs the need to log all actions, and a different setting should be determined. This profile configures the action to be .

Rationale

Taking appropriate action when there is an error sending audit records to a remote system will minimize the possibility of losing audit records.