Hi;

I reading USER_LOGIN logs fom audit.log.
SSHD login trys loging USER_LOGIN line; but FTP logins no write USER_LOGIN line?

Example:

- Trying SSH Connect:

Following lines writing to audit.log
type=USER_AUTH ...
type=USER_ACCT ...
type=USER_START...
type=USER_LOGIN...

- Trying FTP Connect:

Following lines writing to audit.log
type=USER_AUTH ...
type=USER_ACCT ...
(NO USER_LOGIN LINE?)

Wyh this?

Thanks
Best Regards