On Friday, July 14, 2017 4:48:11 PM EDT warron.french wrote:
> Similar idea to the prior email:
>
> I need to monitor local user account
>
>
> *creation, modification, deletion, suspension and locking.*

These events are all hardwired too. The events that you are looking for are
part of this specification:

https://github.com/linux-audit/audit-documentation/wiki/SPEC-User-Account-Lifecycle-Events

As long as audit is enabled, you will get the events.

-Steve

> I know that I can monitor: */etc/passwd, /etc/group, /etc/shadow* and
> */etc/gshadow*, but how do I monitor who modified wfrench inside
> /etc/passwd?
>
> Is:
>
>
> *-w /etc/passwd  -k monitor_account_manipulations*

> Good enough?
>
> --------------------------
> Warron French