Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On a Linux (debian) box, I have a NFS server wich seems to be overloaded by requests. In order to identify the problem, I'm trying to monitor with auditd/auditctl accessed files in the partition exported by the NFS server.

The problem is that our disk or nfs problem prevents auditd to write logs on /var/log/auditd/auditd.log.

What I really need is to send all logs somewhere else than on a local file.

Can I simply redirect all logs from to (the network is working correctly) ?

share|improve this question
Surely, if you use rsyslog as a transport – Vitaly Isaev Aug 28 '14 at 12:15
up vote 3 down vote accepted

I'm assuming you're on Linux by how you phrased your question. Should that be the case, then yes there is, look into audisp-remote and audispd. These are standard components in the current audit tools on Linux.

share|improve this answer
I'm using linux, right (just edited my question). I have just found those two tools. Could not find any documentation except man pages yet... – ascobol Feb 13 '12 at 17:22

You can set the auditd log file in /etc/auditd.conf. You can't make auditd itself send logs over the network, but you can direct it to a file that's on some other remote filesystem such as sshfs.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.