aureport does not log logins

Steve Grubb sgrubb at redhat.com
Fri Jun 27 14:04:18 UTC 2008


On Wednesday 25 June 2008 11:28:10 Bo Phan wrote:
> I know it's something that I need to see but I've been struggling with this
> project for so long. When I do aureport, logins (either successful or
> failed) are not showed.

The login notifications come from patches to the login programs, so you cannot 
add rules to get this. The event type you are looking for is USER_LOGIN. If 
they are not in your logs, aureport cannot work since the data is missing.

-Steve




More information about the Linux-audit mailing list