OS: Suse 9.3
aureport version 1.6.2
I know it's something that I need to see but I've been struggling with this project for so long. When I do aureport, logins (either successful or failed) are not showed.
I watch the /var/log/audit/audit.log and it does not log any logins attempts. Frankly, my audit.rules has the following
-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
But I guess it only watches changes in these 2 logs.
Also, the /var/log/messages does show all login attempts if it points to something. Thanks all for your help.
Bo