Ensure the direction of logs in audisp-remote
plug-in of the audispd audit event multiplexor is correct.
Check that the direction directive in
/etc/audisp/plugins.d/au-remote.conf is out.
Restart the auditd service to apply configuration changes:
$ sudo service auditd restart