On Sunday 25 February 2007 13:41:56 Marcus Meissner wrote: > Most of them have just support for emitting USER_LOGIN audit records. > > Are these necessary, because PAM emits USER_START / USER_END records > anyway...
Yes. NISPOM is concerned about tracking login/logout. How do you distinguish an actual login/logout vs the start of a session with the pam records? su and cron, for example, do not do an actual login yet they create those records. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
