On Friday, July 31, 2015 09:59:13 AM Satish Chandra Kilaru wrote: > I see AUDIT_USER_LOGIN when I ssh to a linux machine.
This means an interactive login session has been started by the user. This is in contract to a cron job which does not create this event. > What action will cause AUDIT_LOGIN event? This means that the loginuid was set. Even a cron job will do this. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
