Check your ssh logs for some kind of logoff message. I can't remember if there is one, or if all of this information in included.
On Thu, Apr 15, 2010 at 6:46 AM, Ozgur Ozdemircili <[email protected]> wrote: > Hi, > I seem to be getting a 5715 message saying user A has logged in to server > B. But I do not receive anything when the same user logs out. > Is there any way ossec can send me an email/ alert when user logs out > stating: > - The ip address of the user > - Username (of course) > - Login / logout time > I want to be able to see when the user logged in, when the same user logged > out to be able to map his actions in the system. > Thanks. > Özgür Özdemircili > http://www.acikkod.org > Code so clean you could eat off it > -- To unsubscribe, reply using "remove me" as the subject.
