USER_END for ssh?

Steve Grubb sgrubb at redhat.com
Wed Aug 17 18:41:53 UTC 2005


On Wednesday 17 August 2005 14:31, Rob Myers wrote:
> should there be a corresponding USER_END message for every USER_START
> message?

In theory, yes.

> i do not see any messages indicating the end of an ssh session, but the
> messages i expect are shown at the start of an ssh session.

Will check this out.

-Steve




More information about the Linux-audit mailing list