auditd stopped sending audit messages to central syslog after restart
Issue
- audit messages stopped logging to central syslog server
- server suddenly stopped receiving logs
- auditd service had to be restarted to receive logs once again
Environment
- Red Hat Enterprise Linux 7.2
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.