RHEL 4 configuration

[Robert Evans]

Hi,

I've got auditing running pretty well on Fedora and looks like SuSE as well, but 
RHEL 4 is giving me some problems.

I'm working off of RHEL 4 with the following updated packages:

   kernel-smp-2.6.9-55.EL.x86_64
   kernel-smp-devel-2.6.9-55.EL.x86_64
   glibc-kernheaders-2.4_9.1.100.EL.x86_64
   audit-libs-1.0.15-3.EL4.x86_64
   audit-1.0.15-3.EL4.x86_64

All other packages are at the original RHEL4 distribution level.

I'm seeing SYSCALL events, but no login/logout/su/ssh events.  Steve had earlier 
mentioned that login/logout/ssh/gdm events are managed by the pam modules.  Are 
there other packages I need to update to get login/logout events working?

As an extra topic, what is the maturity of RHEL5 w/ regard to auditing?

Bob Evans
JHU/APL