OK this may be obvious but have you actually tried using useradd to create an account
before running your ausearch?
From: linux-audit-bounces(a)redhat.com [mailto:linux-audit-bounces@redhat.com] On Behalf Of
Alarie, Maxime
Sent: Monday, July 06, 2015 10:03 AM
To: linux-audit(a)redhat.com
Subject: EXT :How to make sure a specific event is logged with thge proper message type?
Hi,
I have this rule in audit.rules : -w /usr/sbin/useradd -p x -k user_modification
When I add a user, and do a ausearch -m ADD_USER I get 0 match. Am I doing something
wrong here? I am using version 1.8.
Thanks