Good day,

I am new with auditd, and got some issues..

For example,  When I add or delete a user,  I cannot see the entry with ausearch –m ADD_USER, it returns 0 match, BUT  its logging it under USER_AUTH. If I do a ausearch –x adduser, ill thee se event audit.log with the EXECVE Type:

# ausearch -x useradd | grep titi

type=EXECVE msg=audit(1435677075.900:49410): argc=2 a0="useradd" a1="titi"

I also tried to  find a full description of all message types  returned by ausearch –m  but could not find any..  Any help on this would be appreciated as well.

Many thanks.