missing user authentication events.

[Steve Grubb]

On Thursday 25 March 2010 11:17:14 am Robert Harris wrote:
> My setup for auditd is the same in both places. However on the debian
> system I get no audit events for user authentication for things like ssh
> and su.

Maybe a Debian maintainer could answer how they do things...but in the mean 
time, the login events come from user space. On RHEL/Fedora, we have enabled 
auditing in the pam build.

-Steve