Kirkwood, David A. wrote:
When I view the events related to xscreensaver for a locked screen I get 2 separate audit entries, one for a failure and 1 as a success. Both have the same uid, euid, etc. Actually, the entries are exactly the same except for the event number and the success outcome. I have the xscreensaver executable set -rwsr-xr-x.
The failure may be due to xscreensaver not being able to write to the faillog, if you are using pam_tally (to implement three strikes and you are locked out), but I'm just guessing.
-- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
