On a Linux (debian) box, I have a NFS server wich seems to be overloaded by requests. In order to identify the problem, I'm trying to monitor with auditd/auditctl accessed files in the partition exported by the NFS server.

The problem is that our disk or nfs problem prevents auditd to write logs on /var/log/auditd/auditd.log.

What I really need is to send all logs somewhere else than on a local file.

Can I simply redirect all logs from to (the network is working correctly) ?

  • Surely, if you use rsyslog as a transport – Vitaly Isaev Aug 28 '14 at 12:15

I'm assuming you're on Linux by how you phrased your question. Should that be the case, then yes there is, look into audisp-remote and audispd. These are standard components in the current audit tools on Linux.

  • I'm using linux, right (just edited my question). I have just found those two tools. Could not find any documentation except man pages yet... – ascobol Feb 13 '12 at 17:22

You can set the auditd log file in /etc/auditd.conf. You can't make auditd itself send logs over the network, but you can direct it to a file that's on some other remote filesystem such as sshfs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.