ZOS-REMOTE.CONF(5)

📦 version 4.2.1, in alpine 3.22, alpine 3.23, alpine 3.24, arch rolling, centos-stream 10, centos-stream 9, debian bookworm, debian trixie, fedora 43, fedora 44, nixpkgs unstable, opensuse-leap 16.0, ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

🎀 ZOS-REMOTE.CONF(5) 🎀

okay bestie, welcome to zos-remote.conf — it lives in section 5 of the System Administration Utilities manual, and it's literally the whole personality of the audisp-racf plugin. let's get into it 💅

✨ NAME ✨

zos-remote.conf — the audisp-racf plugin configuration file 🦋

💖 DESCRIPTION 💖

so like, zos-remote.conf is the file that controls the configuration for the audispd-zos-remote(8) Audit dispatcher plugin. it's giving main character energy for your audit forwarding setup, no cap.

the default location for this file is /etc/audit/zos-remote.conf, but lowkey you can point at a different file if you want — just pass it as the first argument to the audispd-zos-remote plugin. see audispd-zos-remote(8) and auditd(8) for the deets 🫶

the options available are as follows:

  • server — this is the IBM z/OS ITDS server hostname or IP address. like, where you're sending everything 🌸
  • port — the port number where ITDS is running on the z/OS server. default is 389 (that's the ldap port, iykyk) 🔥
  • user — the z/OS RACF user ID which the audispd-zos-remote plugin will use to perform Remote Audit requests. this user needs READ access to FACILITY Class resource IRR.LDAP.REMOTE.AUDIT (see audispd-zos-remote(8)). permissions check bestie, don't skip it 💀
  • password — the password associated the the z/OS user ID configured above. (yes, that's how the original says it, and yes, it's iconic — protect this file fr fr 🙈)
  • timeout — the number in seconds that the audispd-zos-remote plugin will wait before giving up in connection attempts and event submissions. the default value is 15 ⭐
  • q_depth — the audispd-zos-remote plugin will queue inputted events to the maximum of q_depth events while trying to submit those remotely. this can handle burst of events or in case of a slow network connection. however, the audispd-zos-remote plugin will drop events in case the queue is full 😭 the default queue depth is 64 — increase this value in case you are experiencing event drop due to full queue (audispd-zos-remote will log this to syslog). so if events are ghosting you, this is why, go bump that number 🧚
heads up bestie: when the queue is full, events get dropped. that's not a vibe, that's data loss. the plugin logs it to syslog so at least you'll know 💅

🌈 SEE ALSO 🌈

audispd-zos-remote(8)

👑 AUTHOR 👑

Klaus Heinrich Kiwi <klausk@br.ibm.com>

and that's the whole page, periodt 💜 this one's brought to you by IBM, dated Oct 2007 — vintage but still slaying ✨ mwah, go configure responsibly 🎀

📦 where this page comes from