We have a rule 'Encrypt Audit Records Sent With audispd Plugin' .
It checks that enable_krb5 = yes is set in /etc/audisp/audisp-remote.conf.
We have found that it doesn't work anymore on Fedora 29 and RHEL 8.
I have found that the audisp-remote.conf has moved to /etc/audit and
that "enable_krb5 = yes" option has been superseded by "transport =
I have created a patch  that fixes the rule, OVAL, etc.
However, it turned out that 'transport' option can be set also in
/etc/audit/auditd.conf. It's not clear to me if we should check
/etc/audisp/audisp-remote.conf or /etc/audit/auditd.conf or both.
Which of the 2 configuration files is correct to configure authentication
and encryption for remote logging? Does each of the files mean a different thing?
Security Technologies | Red Hat, Inc.