We are receiving LINUX RHEL versions 5 and 6 in our environment with type=SYSCALL and auid=unset event types.

We are unable to properly monitor an event with AUID=unset, does anyone know why we are currently seeing these and what is the resolution?

Thanks!

Briane Lin
IBM Global Technology Services - Americas
Identity and Access Management, Automation Solutions
(Email): brlin@us.ibm.com
(Office): (720) 395-2049

"The only easy day was yesterday."
    - US Navy Seals -