{
    "mode": "man",
    "parameter": "AUDISP-SYSLOG",
    "section": "8",
    "url": "https://www.chedong.com/phpMan.php/man/AUDISP-SYSLOG/8/json",
    "generated": "2026-10-22T11:58:22Z",
    "synopsis": "audisp-syslog [ OPTIONS ]",
    "sections": {
        "NAME": {
            "content": "audisp-syslog - plugin to push audit events into syslog\n",
            "subsections": []
        },
        "SYNOPSIS": {
            "content": "audisp-syslog [ OPTIONS ]\n",
            "subsections": []
        },
        "DESCRIPTION": {
            "content": "audisp-syslog  is a plugin for the audit event dispatcher that wraps audit events back around\nto syslog. It can be passed three options: one which is the syslog facility, one that is  the\nsyslog level that all events are logged with, and one that determines if events should be in‐\nterpreted.  Valid  facilities  are  LOGLOCAL0 through 7, LOGAUTH, LOGAUTHPRIV, LOGDAEMON,\nLOGSYSLOG, and LOGUSER. Valid levels are LOGDEBUG through LOGEMERG. Setting these options\nis done in the /etc/audit/syslog.conf file on the args line.\n\nIf it is desired that events are interpreted, add the word interpret to the args  line.  This\nwill  cause all events to be interpreted. The drawback to this approach is that naive parsers\ncan be tricked by an adversary that has the ability to name files, processes, or  other  user\ncontrolled objects.\n\nIf  you are aggregating multiple machines, you should edit auditd.conf to set the nameformat\nto something meaningful and the logformat to enriched. This way you can tell where the event\ncame from and have the user name and groups resolved locally before it is sent off of the ma‐\nchine.\n\n",
            "subsections": []
        },
        "FILES": {
            "content": "/etc/audit/plugins/syslog.conf /etc/audit/auditd.conf\n",
            "subsections": []
        },
        "SEE ALSO": {
            "content": "auditd.conf(8), auditd-plugins(5), syslog(3).\n",
            "subsections": []
        },
        "AUTHOR": {
            "content": "Steve Grubb\n\nRed Hat                                      August 2018                            AUDISP-SYSLOG(8)",
            "subsections": []
        }
    },
    "summary": "audisp-syslog - plugin to push audit events into syslog",
    "flags": [],
    "examples": [],
    "see_also": [
        {
            "name": "auditd.conf",
            "section": "8",
            "url": "https://www.chedong.com/phpMan.php/man/auditd.conf/8/json"
        },
        {
            "name": "auditd-plugins",
            "section": "5",
            "url": "https://www.chedong.com/phpMan.php/man/auditd-plugins/5/json"
        },
        {
            "name": "syslog",
            "section": "3",
            "url": "https://www.chedong.com/phpMan.php/man/syslog/3/json"
        }
    ]
}