Re: Audit Prelude Logout Tracking

On Wed, 2009-02-18 at 16:44 -0600, LC Bruzenak wrote: > On Wed, 2009-02-18 at 16:58 -0500, Dan Gruhn wrote: > >> I''m working on an X86_64 RHEL 5.2 system and for NISPOM Chapt. 8 I'm >> looking to modify the audisp-prelude plugin so that I can get logout >> events displayed. >> >> I see the information in the audit.log as USER_END and have done a small >> mod in the handle_event routine in audisp-prelude.c so that it looks for >> AUDIT_USER_END but I've run across the following things: >> >> 1) sshd goes through a login/logout cycle ending in USER_END and all is >> good. >> node=node01 type=USER_END msg=audit(1234979707.894:203): user pid=7422 >> uid=0 auid=0 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 >> msg='PAM: session close acct="root" : exe="/usr/sbin/sshd" >> (hostname=master, addr=10.1.4.100, terminal=ssh res=success)' >> >> >> Dan, The other question I had was, I suppose you see the AUDIT_USER_LOGIN event type which triggers the prelude event (in audisp-prelude.c). I would think that the matching AUDIT_USER_LOGOUT would be what you want right? Can you find these events with ausearch like this?: # ausearch -ts today -i -m USER_LOGIN ...and... #ausearch -ts today -i -m USER_LOGOUT LCB