On Friday, July 31, 2015 09:59:13 AM Satish Chandra Kilaru wrote:
> I see AUDIT_USER_LOGIN when I ssh to a linux machine.
This means an interactive login session has been started by the user. This is
in contract to a cron job which does not create this event.
> What action will cause AUDIT_LOGIN event?
This means that the loginuid was set. Even a cron job will do this.
-Steve