Return
-
Title
If connection between sudo client and policy server is broken mid-flight, what failovers are in place for keystroke log data? -
Description
If connection between sudo client and policy server is broken mid-flight, what failovers are in place for keystroke log data?In the event of a disconnect to the primary policy server, will the keystroke logs continue on a secondary server? Will it continue the keystroke logs with a new file name on the secondary policy server? (for example, <log_file_name> starts on policy server 1, connection dies, <log_file_name_2> is created on policy server 2 and continues with the keystroke logs after connection was lost). -
Resolution
When a connection between a sudo client and policy server is broken mid-flight, the sudo session will hang and eventually terminate. The keystroke logs will only include data up to the point of disconnection, and the corresponding event logs will show exit status of "unfinished" or "Command unfinished no exit status". There is no failover for mid-flight disconnects.If the sudo plugin (a.k.a. client) is unable to initiate a connection with any of the available policy servers, the sudo request is evaluated offline (i.e. locally, on the sudo plugin host) using a cached copy of the QPM4Sudo policy. The logs are collected locally then updated to the policy server when the connection is re-established.