Yep, based on some earlier emails I saved, I think Steve said that ssh needs to be at version 4.3p2-13 or later to generate logout (USER_END) audit records correctly.
Karen Wieprecht -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
