On Thursday 24 May 2007 19:07:21 Michael Folsom wrote:
> Working with audit (ver=1.2.9) on SLES10 sp1 rc2 and wonder if it was
> possible to monitor both logins and logouts.

Logins are denoted by a USER_LOGIN event. There should also be a USER_START 
event from the same tty/pty or host, auid, and pid. This marks the beginning 
of a session. You should be able to look for a corresponding USER_END to 
denote the end of a session. If USER_START results indicates a failure, there 
will not be a USER_END.

> Currently my system is recording when a user logs in but not when they log
> out of a ssh session.  Is this even possible?

With a little inference, its possible. I started to put in a USER_LOGOUT 
event, but I decided its redundant when it can be inferred by the session 
events.

-Steve

--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit

Reply via email to