USER_MGMT event

Steve Grubb sgrubb at redhat.com
Mon Jan 6 13:52:12 UTC 2020


On Monday, January 6, 2020 4:44:07 AM EST MAUPERTUIS, PHILIPPE wrote:
> On Monday, December 30, 2019 12:29:13 PM EST MAUPERTUIS, PHILIPPE wrote:
> > On a RHEL8 server, when playing around with usermod and  chsh, I noticed
> > that usermod -c 'root at xxx' root generates a user_mgmt event
> > But chsh -s /usr/bin/tlog-rec-session root didn't.
> > Is that the expected behavior ?
> 
> It depends. Did you get any event at all? There is a chance that you just
> have mismatching events.
> 
> > I was expecting an event for both.
> 
> There should be an event for both.
> 
> > Should I open a ticket at redhat for this ?
> 
> Let's see what the answer is for the above.

Based on the logs provided, I'd say that opening a ticket is the right thing 
to do.

-Steve





More information about the Linux-audit mailing list