Login/Logout events
Hi,
In doing some testing with the last audit module (testing on FC5) I found the
following behavior
1. login and logout events recorded from GDM login
2. login and logout events recorded from su
3. login events recorded from ssh connections, no logout events (USER_END) logged.
Is there something I need to do to catch these ssh disconnects?
Thanks,
Bob Evans
JHU/APL