Re: auditd not logging proper log.
I did not get you, in kernel auditd is enabled like kauditd is running then what exactly
we have to do changes in my system to get full login n log out info in audit. Log file.
Please help me in giving steps to follow.
Regards,Rakesh
Sent from Yahoo Mail on Android
On Sat, Jul 10, 2021 at 19:57, Steve Grubb<sgrubb(a)redhat.com> wrote: On
Saturday, July 10, 2021 2:28:55 AM EDT Rakesh Kumar wrote:
1)I am trying to run the auditd (start/stop) without root user as
normal
user , how to achieve this on linux.?
For security reasons, this is not allowed.
2)i am using kernel version 4.19.97 and i am not getting any
login/logout,
authentication fail/pass log data in audit.log file. DOes it need any
changes in the config or rules..
This is hardwired into pam. The rules don't matter. I'd check that pam was
compiled with audit support and that audit is enabled in the kernel.
-Steve
Attachments:
- attachment.html (text/html — 2.1 KB)