AUDIT_LOGIN vs AUDIT_USER_LOGIN

[Satish Chandra Kilaru]

Thank you.

On Fri, Jul 31, 2015 at 10:19 AM, Steve Grubb <sgrubb at redhat.com> wrote:

> On Friday, July 31, 2015 09:59:13 AM Satish Chandra Kilaru wrote:
> > I see AUDIT_USER_LOGIN when I ssh to a linux machine.
>
> This means an interactive login session has been started by the user. This
> is
> in contract to a cron job which does not create this event.
>
> > What action will cause AUDIT_LOGIN  event?
>
> This means that the loginuid was set. Even a cron job will do this.
>
> -Steve
>
>


-- 
Please Donate to www.wikipedia.org
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20150731/4772c1f0/attachment.htm>