auditd stops sending audit messages to central syslog server

Solution Verified - Updated -

Issue

  • syslogd requires restart, before remote logging continues
  • audispd and syslog plugin do not get started at boot
  • Audit randomly stops logging messages remotely
  • Remote logging fails randomly
  • audit messages do not make it to the central syslog server
  • The audit service fails to start at boot

Environment

  • Red Hat Enterprise Linux 7.x

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase of over 48,000 articles and solutions.

Current Customers and Partners

Log in for full access

Log In