Steve, thank you for your quick response!<br />
Indeed, that&#39;s the problem. My copy of PAM is not compiled with audit support.<br />
Many thanks, again,<br />
Robert<br />
&#160;
<blockquote class="fm-read-more">
<div data-ng="originalcontent">-------- Eredeti lev&#233;l --------</div>
<br />
Felad&#243;: Steve Grubb &#60;<a href="mailto:sgrubb@redhat.com" rel="nofollow">sgrubb@redhat.com</a>&#62;<br />
D&#225;tum: 2019 m&#225;jus 30 14:31:19<br />
T&#225;rgy: Re: Missing login records - Audit functionality in different kernel versions<br />
C&#237;mzett: <a href="mailto:linux-audit@redhat.com" rel="nofollow">linux-audit@redhat.com</a><br />
<br />
Hello,<br />
<br />
On Thursday, May 30, 2019 3:37:23 AM EDT R&#243;bert Nagy wrote:<br />
&#62; I tested Audit on a Debian 7 (kernel version 3.2.0-5-amd64), but in the<br />
&#62; audit.log I get no USER_AUTH, USER_ACCT, CRED_ACQ, USER_START and<br />
&#62; USER_LOGIN record types at all, Only USER_LOGIN types.<br />
&#62;<br />
&#62; As I understand these records should be there without any rules set.<br />
&#62; https://www.redhat.com/archives/linux-audit/2017-July/msg00046.html<br />
<br />
Yes. These are sent by pam. So, the question would be, is your copy of pam<br />
compiled with audit support?<br />
<br />
ldd /usr/lib64/libpam_misc.so | grep libaudit<br />
libaudit.so.1 =&#62; /lib64/libaudit.so.1 (0x00007f06c2c39000)<br />
<br />
<br />
&#62; On another server with kernel version 4.9 it works properly. Is there a<br />
&#62; possibility that this Audit functionality is not implemented in kernel<br />
&#62; version 3.2, or is this just a configuration issue on my side?<br />
<br />
This should be pam.<br />
<br />
-Steve<br />
<br />
&#62; We have too many Debian 3.x production servers to consider kernel upgrade<br />
&#62; being an option.<br />
&#62;<br />
&#62; If it&#39;s a kernel issue, could you please recommend any workaround?<br />
&#62; Currently I am thinking on parsing the auth.log<br />
&#62;<br />
&#62; Many thanks,<br />
&#62; Robert<br />
&#62;<br />
&#62; auditd.conf:<br />
&#62; log_file = /var/log/audit/audit.log<br />
&#62; log_format = RAW<br />
&#62; log_group = root<br />
&#62; priority_boost = 4<br />
&#62; flush = INCREMENTAL<br />
&#62; freq = 20<br />
&#62; num_logs = 4<br />
&#62; disp_qos = lossy<br />
&#62; dispatcher = /sbin/audispd<br />
&#62; name_format = NONE<br />
&#62; ##name = mydomain<br />
&#62; max_log_file = 5<br />
&#62; max_log_file_action = ROTATE<br />
&#62; space_left = 75<br />
&#62; space_left_action = SYSLOG<br />
&#62; action_mail_acct = root<br />
&#62; admin_space_left = 50<br />
&#62; admin_space_left_action = SUSPEND<br />
&#62; disk_full_action = SUSPEND<br />
&#62; disk_error_action = SUSPEND<br />
&#62; ##tcp_listen_port =<br />
&#62; tcp_listen_queue = 5<br />
&#62; tcp_max_per_addr = 1<br />
&#62; ##tcp_client_ports = 1024-65535<br />
&#62; tcp_client_max_idle = 0<br />
&#62; enable_krb5 = no<br />
&#62; krb5_principal = auditd<br />
&#62; ##krb5_key_file = /etc/audit/audit.key<br />
<br />
<br />
<br />
&#160;</blockquote>