Hello all,<br />
<br />
I tested Audit on a Debian 7 (kernel version 3.2.0-5-amd64), but in the audit.log I get no USER_AUTH, USER_ACCT, CRED_ACQ, USER_START and USER_LOGIN record types at all, Only USER_LOGIN types.<br />
<br />
As I understand these records should be there without any rules set.<br />
https://www.redhat.com/archives/linux-audit/2017-July/msg00046.html<br />
<br />
On another server with kernel version 4.9 it works properly. Is there a possibility that this Audit functionality is not implemented in kernel version 3.2, or is this just a configuration issue on my side?<br />
<br />
We have too many Debian 3.x production servers to consider kernel upgrade being an option.<br />
<br />
If it&#39;s a kernel issue, could you please recommend any workaround? Currently I am thinking on parsing the auth.log<br />
<br />
Many thanks,<br />
Robert<br />
<br />
auditd.conf:<br />
log_file = /var/log/audit/audit.log<br />
log_format = RAW<br />
log_group = root<br />
priority_boost = 4<br />
flush = INCREMENTAL<br />
freq = 20<br />
num_logs = 4<br />
disp_qos = lossy<br />
dispatcher = /sbin/audispd<br />
name_format = NONE<br />
##name = mydomain<br />
max_log_file = 5<br />
max_log_file_action = ROTATE<br />
space_left = 75<br />
space_left_action = SYSLOG<br />
action_mail_acct = root<br />
admin_space_left = 50<br />
admin_space_left_action = SUSPEND<br />
disk_full_action = SUSPEND<br />
disk_error_action = SUSPEND<br />
##tcp_listen_port =<br />
tcp_listen_queue = 5<br />
tcp_max_per_addr = 1<br />
##tcp_client_ports = 1024-65535<br />
tcp_client_max_idle = 0<br />
enable_krb5 = no<br />
krb5_principal = auditd<br />
##krb5_key_file = /etc/audit/audit.key