I've setup audit and a logging server to receive audit messages. There is a another system I want to audit, on a different network. If I point that system to the system that can talk to the audit server, will audit records waterfall over?

i.e. can I do

system A audit -> system B audit -> logging system?

will audit be forwarded? or does this issue require more convoluted work?

thanks

The right answer would be to get a request in to change network ACLs / packet filtering rules so that system A could send messages directly to the logging system. In the arrangement you describe, accurate capture of system A's logs is fully dependent on system B. (What if system B runs into trouble and goes offline?)

I haven't actually tested what you're describing, but I would think that if system A sends log messages that match the facility/level that system B is already configured to send to the logging system they'd get sent there together. (Only one way to find out for sure, though. Test it.)

ACLs and packet filtering rules like that for other reasons are specifically not allowed; Testing it sounds about the only way to verify then, thanks!