fix--audit-logs-in-message
==========================

Configure whether auditd should send events to syslog or not.

Default is *not*, since auditd's own native logging to disk (/var/log/audit/) should suffice.

Sending auditd events to syslog will cause "logging storms" if auditd is monitoring rsyslog. Which is currently the case when mdatp (Microsoft Defender) has also been installed on the target.


Role Variables
--------------

See defaults/main.yml.


Example Playbook
----------------

Enable auditd send events to syslog (default is "no"):

    - hosts: servers
      roles:
         - role: fix--audit-logs-in-message
           vars: auditd_syslog_active: "yes"


OS version support
------------------

- RHEL 7
- RHEL 8


Todo
----

- Add support for RHEL 9.
- Local folder tests/ has not been tested. :)
- Consider making more generic by adding variables controlling auditd logs for better local log retention etc.
- Adapt to Ansible best practices.
  - Use ansible-lint.
  - Rename role.
  - Use FQCN in tasks (see https://docs.ansible.com/ansible/latest/porting_guides/porting_guide_2.10.html).
