Ensure the executable used by audisp-remote
plug-in of the audispd
audit event multiplexor is correct.
Check that the path
directive in
/etc/audisp/plugins.d/au-remote.conf
is /sbin/audisp-remote
.
Restart the auditd
service to apply configuration changes:
$ sudo service auditd restart