Audit records on screen

Kris Wilson krisw at us.ibm.com
Fri Jul 15 17:07:19 UTC 2005


We are seeing the following audit records frequently displaying on the
xSeries and opteron consoles.  We don't see these when accessing remotely.

audit(1121277961.150:13073995): user pid=13666 uid=0 auid=500 msg='PAM 
accounting: user=root exe="/usr/sbin/crond" (hostname=?, addr=?, 
terminal=cron result=Success)'
audit(1121277961.151:13074064): login pid=13666 uid=0 old auid=500 new 
auid=0
audit(1121277961.151:13074070): user pid=13666 uid=0 auid=0 msg='PAM 
session open: user=root exe="/usr/sbin/crond" (hostname=?, addr=?, 
terminal=cron result=Success)'
audit(1121277961.151:13074079): user pid=13666 uid=0 auid=0 msg='PAM 
setcred: user=root exe="/usr/sbin/crond" (hostname=?, addr=?, 
terminal=cron result=Success)'
audit(1121277961.156:13074258): user pid=13666 uid=0 auid=0 msg='PAM 
setcred: user=root exe="/usr/sbin/crond" (hostname=?, addr=?, 
terminal=cron result=Success)'
audit(1121277961.157:13074277): user pid=13666 uid=0 auid=0 msg='PAM 
session close: user=root exe="/usr/sbin/crond" (hostname=?, addr=?, 
terminal=cron result=Success)'

P.S. I hope this is not arriving as HTML; had to reinstall my desktop - 
have set default to plain text but who knows....




More information about the Linux-audit mailing list