I suggest that you install the Splunk Universal Forwarder on the RedHat 5.8 box. Simply configure the forwarder to monitor the audit logs and output to the Splunk indexers. This will use TCP for transport and be more resilient than rsyslog over UDP.
For the most trivial installation possible:
- Configure your Splunk indexer to listen for forwarded data on a "receiving port." (For this example: 9997)
- Pick or create a non-privileged user to run Splunk on the RedHat box. (how about splunkIT for this example)
- Download the Splunk Universal Forwarder to the RedHat box and install. (Install anywhere, but assume /opt/splunk for this example)
- Execute the following commands
Of course, there are many more ways to configure this, but this is simple and will survive reboots. It will also restart wherever it left off in the audit logs, should Splunk be stopped/restarted. It is intelligent about rolling log files.