On Monday, January 6, 2020 4:44:07 AM EST MAUPERTUIS, PHILIPPE wrote: > On Monday, December 30, 2019 12:29:13 PM EST MAUPERTUIS, PHILIPPE wrote: > > On a RHEL8 server, when playing around with usermod and chsh, I noticed > > that usermod -c 'root@xxx' root generates a user_mgmt event > > But chsh -s /usr/bin/tlog-rec-session root didn't. > > Is that the expected behavior ? > > It depends. Did you get any event at all? There is a chance that you just > have mismatching events. > > > I was expecting an event for both. > > There should be an event for both. > > > Should I open a ticket at redhat for this ? > > Let's see what the answer is for the above.
Based on the logs provided, I'd say that opening a ticket is the right thing to do. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
