AUDISP-REMOTE(8) System Administration Utilities AUDISP-REMOTE(8)

# [NAME](#NAME)

audisp-remote - plugin for remote logging

# [SYNOPSIS](#SYNOPSIS)

**audisp-remote**

# [DESCRIPTION](#DESCRIPTION)

**audisp-remote** is a plugin for the audit event dispatcher that performs remote logging to an aggregate logging server. When the plugin is sent **SIGUSR1**, it writes a state report to **remote.state**.

# [TIPS](#TIPS)

If you are aggregating multiple machines, you should edit auditd.conf to set the name\_format to something meaningful and the log\_format to enriched. This way you can tell where the event came from and have the user name and groups resolved locally before it is sent off of the machine.

# [SIGNALS](#SIGNALS)

[SIGUSR1](#SIGUSR1)

Causes the audisp-remote program to write a state report to **remote.state** in **/run/audit**. The *suspend* flag tells whether or not logging has been suspended. The *remote\_ended* flag tells if the connection was broken by the server saying it can't log events. The *transport\_ok* flag tells whether or not the connection to the remote server is healthy. The *queue\_length* tells how many records are enqueued to be sent to the remote server. The *max\_queued\_length* shows the peak queue length since startup. The report also records glibc memory consumption when available.

[SIGUSR2](#SIGUSR2)

Causes the audisp-remote program to resume logging if it were suspended due to an error.

# [FILES](#FILES)

/etc/audit/audisp-remote.conf /etc/audit/plugins.d/au-remote.conf /etc/audit/auditd.conf /run/audit/remote.state

# [SEE ALSO](#SEE_ALSO)

[**auditd.conf**(8)](/man/os/audit/auditd.conf.8), [**auditd-plugins**(5)](/man/os/audit/auditd-plugins.5), [**audisp-remote.conf**(5)](/man/os/audit/audisp-remote.conf.5).

# [AUTHOR](#AUTHOR)

Steve Grubb

May 2024 Red Hat

---

Document: audisp-remote(8) from audit 4.2.1-r2 (Chainguard OS)
Source: https://github.com/linux-audit/audit-userspace