Re: Audit config for NISPOM req's
On Friday 12 January 2007 13:45, Kirkwood, David A. wrote:
Then when I execute aureport -w --failed, the auid field shows up as
-1
as it does for every watch list. Am I missing something?
Yes.
#cd /etc/pam.d
#grep loginuid *
See if you have that in your pam stack. You should see something like this:
atd:session required pam_loginuid.so
crond:session required pam_loginuid.so
gdm:session required pam_loginuid.so
gdm-autologin:session required pam_loginuid.so
kcheckpass:session required pam_loginuid.so
kdm:session required pam_loginuid.so
kdm-np:session required pam_loginuid.so
kscreensaver:session required pam_loginuid.so
login:session required pam_loginuid.so
remote:session required pam_loginuid.so
sshd:session required pam_loginuid.so
vsftpd:session required pam_loginuid.so
xdm:session required pam_loginuid.so
-Steve