Re: AUDIT_LOGIN vs AUDIT_USER_LOGIN

On Friday, July 31, 2015 09:59:13 AM Satish Chandra Kilaru wrote: > I see AUDIT_USER_LOGIN when I ssh to a linux machine. This means an interactive login session has been started by the user. This is in contract to a cron job which does not create this event. > What action will cause AUDIT_LOGIN event? This means that the loginuid was set. Even a cron job will do this. -Steve