Configure the audispd plugin to off-load audit records onto a different
system or media from the system being audited.
First, set the active option in
/etc/audisp/plugins.d/au-remote.conf
Set the remote_server option in /etc/audit/audisp-remote.conf
with an IP address or hostname of the system that the audispd plugin should
send audit records to. For example
remote_server =