How to leverage auditd & rsyslog to send select audit events to specific files or hosts

Solution Verified - Updated -


  • How can we get selected audit events to show up in /var/log/messages or other log files?

  • Our system has many audit rules and the generated events all show up in /var/log/audit/audit.log, but we want certain select events to also be passed to rsyslog for further processing. How can we do this?


  • Red Hat Enterprise Linux
  • rsyslog
  • auditd

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content