Manpages - zos-remote.conf.5

Table of Contents


zos-remote.conf - the audisp-racf plugin configuration file


zos-remote.conf controls the configuration for the *audispd-zos-remote*(8) Audit dispatcher plugin. The default location for this file is /etc/audit/zos-remote.conf, however, a different file can be specified as the first argument to the audispd-zos-remote plugin. See *audispd-zos-remote*(8) and *auditd*(8). The options available are as follows:

This is the IBM z/OS ITDS server hostname or IP address
The port number where ITDS is running on the z/OS server. Default is 389 (ldap port)
The z/OS RACF user ID which the audispd-zos-remote plugin will use to perform Remote Audit requests. This user needs READ access to FACILITY Class resource IRR.LDAP.REMOTE.AUDIT (See *audispd-zos-remote*(8)).
The password associated the the z/OS user ID configured above.
The number in seconds that audispd-zos-remote plugin will wait before giving up in connection attempts and event submissions. The default value is 15
The audispd-zos-remote plugin will queue inputted events to the maximum of q_depth events while trying to submit those remotely. This can handle burst of events or in case of a slow network connection. However, the audispd-zos-remote plugin will drop events in case the queue is full. The default queue depth is 64 - Increase this value in case you are experiencing event drop due to full queue (audispd-zos-remote will log this to syslog).




Klaus Heinrich Kiwi <>

Author: dt

Created: 2022-02-20 Sun 09:35