USER_MGMT event
Steve Grubb
sgrubb at redhat.com
Mon Jan 6 13:52:12 UTC 2020
On Monday, January 6, 2020 4:44:07 AM EST MAUPERTUIS, PHILIPPE wrote:
> On Monday, December 30, 2019 12:29:13 PM EST MAUPERTUIS, PHILIPPE wrote:
> > On a RHEL8 server, when playing around with usermod and chsh, I noticed
> > that usermod -c 'root at xxx' root generates a user_mgmt event
> > But chsh -s /usr/bin/tlog-rec-session root didn't.
> > Is that the expected behavior ?
>
> It depends. Did you get any event at all? There is a chance that you just
> have mismatching events.
>
> > I was expecting an event for both.
>
> There should be an event for both.
>
> > Should I open a ticket at redhat for this ?
>
> Let's see what the answer is for the above.
Based on the logs provided, I'd say that opening a ticket is the right thing
to do.
-Steve
More information about the Linux-audit
mailing list