Information
Information stored in one location is vulnerable to accidental or incidental deletion or alteration.
Off-loading is a common process in information systems with limited audit storage capacity.
Without the configuration of the 'au-remote' plugin, the audisp-remote daemon will not off load the logs from the system being audited.
Satisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224
Solution
Edit the /etc/audisp/plugins.d/au-remote.conf file and add or update the following values:
direction = out
path = /sbin/audisp-remote
type = always
The audit daemon must be restarted for changes to take effect:
# service auditd restart