NAME

       audispd - an event multiplexor

SYNOPSIS

       audispd

DESCRIPTION

       audispd  is  an audit event multiplexor. It has to be started by the audit daemon in order to get events.
       It takes audit events and distributes them to child programs that want to  analyze  events  in  realtime.
       When  the  audit  daemon  receives a SIGTERM or SIGHUP, it passes that signal to the dispatcher, too. The
       dispatcher in turn passes those signals to its child processes.

       The child programs install a configuration file in a plugins directory, /etc/audisp/plugins.d.  Filenames
       are not allowed to have more than one '.' in the name or it will be treated as a backup copy and skipped.
       Options are given one per line with an equal sign between  the  keyword  and  its  value.  The  available
       options are as follows:

       active The options for this are yes or no.

       direction
              The  option  is  dictated by the plugin.  In or out are the only choices. You cannot make a plugin
              operate in a way it wasn't designed just by changing this option.This option is to give a clue  to
              the  event  dispatcher  about  which direction events flow. NOTE: inbound events are not supported
              yet.

       path   This is the absolute path to the plugin executable. In the case of internal plugins, it  would  be
              the name of the plugin.

       type   This tells the dispatcher how the plugin wants to be run. Choices are builtin and always.  Builtin
              should always be given for plugins that are internal to the  audit  event  dispatcher.  These  are
              af_unix  and  syslog.  The  option always should be given for most if not all plugins. The default
              setting is always.

       args   This allows you to pass arguments to the child program. Generally plugins do  not  take  arguments
              and  have  their own config file that instructs them how they should be configured. At the moment,
              there is a limit of 2 args.

       format The valid options for this are binary and string.  Binary passes the data  exactly  as  the  audit
              event  dispatcher  gets  it  from  the  audit  daemon.  The  string option tells the dispatcher to
              completely change the event into a string suitable for parsing with the audit parsing library. The
              default value is string.

FILES

       /etc/audisp/audispd.conf /etc/audisp/plugins.d

SEE ALSO

       audispd.conf(5), auditd(8).

AUTHOR

       Steve Grubb