<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN"> <HTML> <HEAD> <META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8"> <META NAME="GENERATOR" CONTENT="GtkHTML/3.24.1.1"> </HEAD> <BODY> Does anyone know if the auditd on RHEL4 is capable of capturing logon/logoff and failed authentication events? This seems to work flawlessly without any additional changes on a RHEL5 system. Would this just be a configuration change in the PAM stack to allow auditd to get these events, rather than using syslog? Any ideas would be helpful. Thanks, Kevin </BODY> </HTML>