AUDISP-REMOTE(8)

✨ AUDISP-REMOTE 💅

okay bestie, this is the manual page for audisp-remote — a System Administration Utility from the audit girlies. sit down, grab a strawberry, we're doing remote logging today 🍓

---

🌸 NAME 🌸

audisp-remote — it's a plugin for remote logging, periodt 💖

---

🦋 SYNOPSIS 🦋

audisp-remote

like… that's it. that's the whole vibe. no flags in the synopsis, she just runs ✨

---

👑 DESCRIPTION 👑

so audisp-remote is a plugin for the audit event dispatcher, and what she does is remote logging to an aggregate logging server. that's her whole thing. main character energy, lowkey 🌈

and here's the lil trick you need to know: when the plugin gets sent SIGUSR1, she writes a state report to remote.state. that's your little peek behind the curtain 💅

---

🎀 TIPS 🎀

okay so if you're aggregating multiple machines (and if you are, you're iconic), you should edit auditd.conf and:

• set name_format to something meaningful ✨
• set log_format to enriched 💖

why tho? because then you can actually tell where the event came from, and you get the user name and groups resolved locally before the event is sent off of the machine. no cap, it's giving organized. it's giving responsible. we love her 🫶

---

🧚 SIGNALS 🧚

SIGUSR1

makes the audisp-remote program write a state report to remote.state in /run/audit. and girl, that report is detailed — here's the tea it spills:

• the suspend flag — tells whether or not logging has been suspended
• the remote_ended flag — tells if the connection was broken by the server saying it can't log events 😭
• the transport_ok flag — tells whether or not the connection to the remote server is healthy
• the queue_length — tells how many records are enqueued to be sent to the remote server
• the max_queued_length — shows the peak queue length since startup 🔥
• and it also records glibc memory consumption when available

that's a full vibe check on your logging pipeline, honestly 💀✨

SIGUSR2

makes the audisp-remote program resume logging if it were suspended due to an error. it's the "you're so back" signal 🫶

---

🍓 FILES 🍓

• /etc/audit/audisp-remote.conf
• /etc/audit/plugins.d/au-remote.conf
• /etc/audit/auditd.conf
• /run/audit/remote.state

---

⭐ SEE ALSO ⭐

• auditd.conf(8)
• auditd-plugins(5)
• audisp-remote.conf(5)

---

💜 AUTHOR 💜

Steve Grubb

---

okay that's the whole page bestie, you ate this 🎀 go forth and log remotely 🌈💖

this lil doc came from Red Hat, dated May 2024, and yes she's still AUDISP-REMOTE(8) — same girl, same manual section, mwah 💅✨