audit_log_user_message question

[LC Bruzenak]

On Tue, 2008-05-27 at 14:01 -0400, Steve Grubb wrote:
> On Tuesday 27 May 2008 13:56:03 LC Bruzenak wrote:
> > In looking at the user application audit I'm wondering why there is a
> > "hostname" field there?
> 
> So that apps like sshd can say where the user is coming from.
> 
> 
> > I understand the obvious answer but would think I'd trust the auditd or
> > audispd more than an application for the hostname answer, and those
> > would be consistent.
> 
> That's a different hostname. :)

Right! 
Sorry; I promise I'll get it one of these days.
> 
> The hostname field as used in audit_log_user_message would be a remote machine 
> name and not the local address. Many apps do not need this field and should 
> pass NULL if unused.
> 
> -Steve


Thanks again,
LCB.

-- 
LC (Lenny) Bruzenak
lenny at magitekltd.com