aureport does not log logins

Bo Phan beowulfnewbee at gmail.com
Wed Jun 25 15:28:10 UTC 2008


OS: Suse 9.3
aureport version 1.6.2

I know it's something that I need to see but I've been struggling with this
project for so long. When I do aureport, logins (either successful or
failed) are not showed.
I watch the /var/log/audit/audit.log and it does not log any logins
attempts. Frankly, my audit.rules has the following
-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
 But I guess it only watches changes in these 2 logs.

Also, the /var/log/messages does show all login attempts if it points to
something. Thanks all for your help.
Bo
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20080625/00114eba/attachment.htm>


More information about the Linux-audit mailing list