Re: audit_log_user_message question
On Tuesday 27 May 2008 13:56:03 LC Bruzenak wrote:
In looking at the user application audit I'm wondering why there
is a
"hostname" field there?
So that apps like sshd can say where the user is coming from.
I understand the obvious answer but would think I'd trust the
auditd or
audispd more than an application for the hostname answer, and those
would be consistent.
That's a different hostname. :)
The hostname field as used in audit_log_user_message would be a remote machine
name and not the local address. Many apps do not need this field and should
pass NULL if unused.
-Steve