Number of TTY events vs Number of USER_TTY events

[Smith, Gary R]

Good afternoon,

I have TTY auditing set up on a number of hosts using pam_tty_audit for the root account. I have this line in a PAM file to enable it:

session   required pam_tty_audit.so disable=* enable=root

In looking at the reports from aureport and ausearch, the number of TTY events is always equal to the number of USER_TTY events. For instance:

# ausearch -i -m TTY -ts today | wc -l ; ausearch -i -m USER_TTY -ts today | wc -l
20
20

I started wondering, “Are there always the same number of these two event types?” I tried constructing some synthetic cases to see if there is a case where there isn’t an equal number of the two events. I couldn’t construct such a case.  Is there a case of cases where the two type event types aren’t of equal number?

Thanks for your help,

Gary Smith

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20190807/9e0a4e9a/attachment.htm>