RE: How to make sure a specific event is logged with thge proper message type?

Thanks for the reply. Of course :) I also tried DEL_USER on a deleted user, and nothing gets logged under that type, also I never get the hostname and addr fileds filled up.. Its always hostname=? And addr=? Help is aprecited. De : Boyce, Kevin P (AS) [mailto:Kevin.Boyce@ngc.com] Envoyé : 6 juillet 2015 11:08 À : Alarie, Maxime; linux-audit(a)redhat.com Objet : RE: How to make sure a specific event is logged with thge proper message type? OK this may be obvious but have you actually tried using useradd to create an account before running your ausearch? From: linux-audit-bounces@redhat.com<mailto:linux-audit-bounces@redhat.com> [mailto:linux-audit-bounces@redhat.com] On Behalf Of Alarie, Maxime Sent: Monday, July 06, 2015 10:03 AM To: linux-audit@redhat.com<mailto:linux-audit@redhat.com> Subject: EXT :How to make sure a specific event is logged with thge proper message type? Hi, I have this rule in audit.rules : -w /usr/sbin/useradd -p x -k user_modification When I add a user, and do a ausearch -m ADD_USER I get 0 match. Am I doing something wrong here? I am using version 1.8. Thanks