Authentication Events

[Kevin Boyce]

Does anyone know if the auditd on RHEL4 is capable of capturing
logon/logoff and failed authentication events?  This seems to work
flawlessly without any additional changes on a RHEL5 system.
Would this just be a configuration change in the PAM stack to allow
auditd to get these events, rather than using syslog?

Any ideas would be helpful.

Thanks,
Kevin
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20090114/96f0f15e/attachment.htm>