---
name: "audisp-remote"
section: "8"
platform: "linux"
package: "audispd-plugins"
version: "4.2.1-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/audisp-remote"
---

# audisp-remote(8)

plugin for remote logging

## NAME

audisp-remote - plugin for remote logging

## SYNOPSIS

**audisp-remote**

## DESCRIPTION

**audisp-remote** is a plugin for the audit event dispatcher that performs remote logging to an aggregate logging server. When the plugin is sent **SIGUSR1**, it writes a state report to **remote.state**.

## TIPS

If you are aggregating multiple machines, you should edit auditd.conf to set the name\_format to something meaningful and the log\_format to enriched. This way you can tell where the event came from and have the user name and groups resolved locally before it is sent off of the machine.

## SIGNALS

- SIGUSR1

  Causes the audisp-remote program to write a state report to **remote.state** in **/run/audit**. The *suspend* flag tells whether or not logging has been suspended. The *remote\_ended* flag tells if the connection was broken by the server saying it can't log events. The *transport\_ok* flag tells whether or not the connection to the remote server is healthy. The *queue\_length* tells how many records are enqueued to be sent to the remote server. The *max\_queued\_length* shows the peak queue length since startup. The report also records glibc memory consumption when available.

- SIGUSR2

  Causes the audisp-remote program to resume logging if it were suspended due to an error.

## FILES

/etc/audit/audisp-remote.conf /etc/audit/plugins.d/au-remote.conf /etc/audit/auditd.conf /run/audit/remote.state

## SEE ALSO

**auditd.conf**(8), [**auditd-plugins**(5)](/auditd-plugins/5.md), [**audisp-remote.conf**(5)](/audisp-remote.conf/5.md).

## AUTHOR

Steve Grubb