On Tue, 2008-05-27 at 14:01 -0400, Steve Grubb wrote: > On Tuesday 27 May 2008 13:56:03 LC Bruzenak wrote: > > In looking at the user application audit I'm wondering why there is a > > "hostname" field there? > > So that apps like sshd can say where the user is coming from. > > > > I understand the obvious answer but would think I'd trust the auditd or > > audispd more than an application for the hostname answer, and those > > would be consistent. > > That's a different hostname. :)
Right! Sorry; I promise I'll get it one of these days. > > The hostname field as used in audit_log_user_message would be a remote > machine > name and not the local address. Many apps do not need this field and should > pass NULL if unused. > > -Steve Thanks again, LCB. -- LC (Lenny) Bruzenak [EMAIL PROTECTED] -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
