It just means Audit Login Context is set...

I actually see that event when I ssh.

On Fri, Jul 31, 2015 at 9:59 AM, Satish Chandra Kilaru <iam.kilaru@gmail.com> wrote:

I see AUDIT_USER_LOGIN when I ssh to a linux machine. What action will cause AUDIT_LOGIN event?

--
Please Donate to www.wikipedia.org