auditd stops sending audit messages to central syslog server

Solution Verified - Updated -


  • syslogd requires restart, before remote logging continues
  • audispd and syslog plugin do not get started at boot
  • Audit randomly stops logging messages remotely
  • Remote logging fails randomly
  • audit messages do not make it to the central syslog server
  • The audit service fails to start at boot


  • Red Hat Enterprise Linux 7.x

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In