Re: missing user authentication events.
On Thursday 25 March 2010 11:17:14 am Robert Harris wrote:
My setup for auditd is the same in both places. However on the
debian
system I get no audit events for user authentication for things like ssh
and su.
Maybe a Debian maintainer could answer how they do things...but in the mean
time, the login events come from user space. On RHEL/Fedora, we have enabled
auditing in the pam build.
-Steve