On Thursday 24 May 2007 19:07:21 Michael Folsom wrote: > Working with audit (ver=1.2.9) on SLES10 sp1 rc2 and wonder if it was > possible to monitor both logins and logouts.
Logins are denoted by a USER_LOGIN event. There should also be a USER_START event from the same tty/pty or host, auid, and pid. This marks the beginning of a session. You should be able to look for a corresponding USER_END to denote the end of a session. If USER_START results indicates a failure, there will not be a USER_END. > Currently my system is recording when a user logs in but not when they log > out of a ssh session. Is this even possible? With a little inference, its possible. I started to put in a USER_LOGOUT event, but I decided its redundant when it can be inferred by the session events. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
