aureport does not log logins
Steve Grubb
sgrubb at redhat.com
Fri Jun 27 14:04:18 UTC 2008
On Wednesday 25 June 2008 11:28:10 Bo Phan wrote:
> I know it's something that I need to see but I've been struggling with this
> project for so long. When I do aureport, logins (either successful or
> failed) are not showed.
The login notifications come from patches to the login programs, so you cannot
add rules to get this. The event type you are looking for is USER_LOGIN. If
they are not in your logs, aureport cannot work since the data is missing.
-Steve
More information about the Linux-audit
mailing list