On Wednesday 25 June 2008 11:28:10 Bo Phan wrote: > I know it's something that I need to see but I've been struggling with this > project for so long. When I do aureport, logins (either successful or > failed) are not showed.
The login notifications come from patches to the login programs, so you cannot add rules to get this. The event type you are looking for is USER_LOGIN. If they are not in your logs, aureport cannot work since the data is missing. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
