auditd not logging proper log.

[Rakesh Kumar]

Pheba

Sent from Yahoo Mail on Android 
 
  On Sat, Jul 10, 2021 at 19:57, Steve Grubb<sgrubb at redhat.com> wrote:   On Saturday, July 10, 2021 2:28:55 AM EDT Rakesh Kumar wrote:
> 1)I am trying to run the auditd (start/stop)  without root user as normal
> user , how to achieve this on linux.?

For security reasons, this is not allowed.

> 2)i am using kernel version 4.19.97 and i am not getting any login/logout,
> authentication fail/pass log data in audit.log file. DOes it need any
> changes in the config or rules..

This is hardwired into pam. The rules don't matter. I'd check that pam was 
compiled with audit support and that audit is enabled in the kernel.

-Steve


  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20210729/2af9873e/attachment.htm>