audit_log_user_message question
Steve Grubb
sgrubb at redhat.com
Tue May 27 18:01:51 UTC 2008
On Tuesday 27 May 2008 13:56:03 LC Bruzenak wrote:
> In looking at the user application audit I'm wondering why there is a
> "hostname" field there?
So that apps like sshd can say where the user is coming from.
> I understand the obvious answer but would think I'd trust the auditd or
> audispd more than an application for the hostname answer, and those
> would be consistent.
That's a different hostname. :)
The hostname field as used in audit_log_user_message would be a remote machine
name and not the local address. Many apps do not need this field and should
pass NULL if unused.
-Steve
More information about the Linux-audit
mailing list