When I view the events related to xscreensaver for a locked
screen I get 2 separate audit entries, one for a failure and 1 as a
success. Both have the same uid, euid, etc. Actually, the entries are exactly
the same except for the event number and the success outcome. I have the
xscreensaver executable set -rwsr-xr-x.
Thanks,
David A.
Kirkwood