I see AUDIT_USER_LOGIN when I ssh to a linux machine. What action will cause AUDIT_LOGIN  event? 

--