Sending Auditd Logs to Central Server Uubntu 22.04

I want to setup logging using auditd on multiple clients and send their logs to a central logging server (using audispd-plugins package).

I was following a couple of guides:

But I don't see the logs for the client in /var/log/audit/audit.log on the central server.

Here are my steps

Logging Server

sudo apt install -y auditd

Edit the logging config file to allow listen to port 60.

sudo vim /etc/audit/auditd.conf

Add the following line.

tcp_listen_port = 60

Edit /etc/audit/auditd.conf to have the following line:

name_format = hostname

Restart the daemon.

sudo service auditd restart

Logging Clients

Install auditd and audispd

sudo apt install -y audispd-plugins

Alter /etc/audit/rules.d

Use the following template and update /etc/audit/rules.d: https://github.com/Neo23x0/auditd/blob/master/audit.rules

sudo sucd /etc/audit/rules.drm audit.ruleswget https://raw.githubusercontent.com/Neo23x0/auditd/master/audit.rules

Alter settings to send logs to Logging Server

vim /etc/audit/audisp-remote.conf

Add the following to the top of the conf file.

remote_server = <ip of logging server>port = 60

Edit /etc/audit/auditd.conf to have the following line:

name_format = hostname

Activate remote logging pluginsOpen the following file.

vim /etc/audit/plugins.d/au-remote.conf

Edit the file to match the following.

active = yes

Finally, restart the service.

service auditd restart