Re: pam_tty_audit

Hello, ----- Original Message ----- Are you talking about TTY or USER_TTY records, and are you checking immediately after entering the command, or after exiting the session? Unprivileged users are not allowed to send USER_TTY records as each command is entered, so the input read by unprivileged users is audited only when the (4 KB) buffer is flushed or the process (i.e. the shell) exits. Mirek