Re: audisp-prelude login question

Nope...somewhere the pam originating events are being eaten. You might strace an xdm login and look for some sendto's followed immediately by recvfrom's to the audit socket. If they are missing entirely, then xdm is not calling pam. If they are there, we'd want to look at the return code to see if its having an error. Is xdm running as root at the point pam is called? Are there selinux rules? Are there dontaudit rules eating this?