missing user authentication events.

[Robert Harris]

On 03/25/2010 12:09 PM, Steve Grubb wrote:
> On Thursday 25 March 2010 11:17:14 am Robert Harris wrote:
>   
>> My setup for auditd is the same in both places. However on the debian
>> system I get no audit events for user authentication for things like ssh
>> and su.
>>     
> Maybe a Debian maintainer could answer how they do things...but in the mean 
> time, the login events come from user space. On RHEL/Fedora, we have enabled 
> auditing in the pam build.
>
> -Steve
>   
Would it be possible for me to check for it being enabled? it looks as
though it is not. is it very hard to add the fix? or would I be better
off trying to build a package from another distro that has it enabled? 
I believe my libpam version is 0.81.12 and I have 0.81.8 on an opensuse
box that works just fine with user authentication auditing.