Auditing Logons/Logoffs

Back to this again, as I thought my coworker had addressed it months ago, but he did not as I cannot find anything. *THE_SUBJECT*: Auditing Logons and Logoffs (success/failures) I am aware of the following files: /var/log/faillog, and /var/log/lastlog The following link is relevant to RHEL5 (maybe 6 and 7??): https://www.stigviewer.com/stig/oracle_linux_5/2015-12-07/finding/V-818 Is there an appropriate syscall for handling *THE_SUBJECT*? Do I use the syntax as advised in the link provided at stigviewer.com? We are dealing with systems that do tie into IPA, but have to ensure *THE_SUBJECT* is being addressed and forwarded. I have to support both RHEL6 and RHEL7. Thanks in advance, -------------------------- Warron French