aureport does not log logins
Bo Phan
beowulfnewbee at gmail.com
Wed Jun 25 15:28:10 UTC 2008
OS: Suse 9.3
aureport version 1.6.2
I know it's something that I need to see but I've been struggling with this
project for so long. When I do aureport, logins (either successful or
failed) are not showed.
I watch the /var/log/audit/audit.log and it does not log any logins
attempts. Frankly, my audit.rules has the following
-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
But I guess it only watches changes in these 2 logs.
Also, the /var/log/messages does show all login attempts if it points to
something. Thanks all for your help.
Bo
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20080625/00114eba/attachment.htm>
More information about the Linux-audit
mailing list