auditd stops sending audit messages to central syslog server
Issue
syslogd
requires restart, before remote logging continuesaudispd
andsyslog
plugin do not get started at boot- Audit randomly stops logging messages remotely
- Remote logging fails randomly
audit
messages do not make it to the central syslog server- The audit service fails to start at boot
Environment
- Red Hat Enterprise Linux 7.x
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.