In looking at the user application audit I'm wondering why there is a "hostname" field there?

On Tuesday 27 May 2008 13:56:03 LC Bruzenak wrote: > In looking at the user application audit I'm wondering why there is a > "hostname" field there? So that apps like sshd can say where the user is coming from. > I understand the obvious answer but would think I'd trust the auditd or > audispd more than an application for the hostname answer, and those > would be consistent. That's a different hostname. :)

The hostname field as used in audit_log_user_message would be a remote machine name and not the local address. Many apps do not need this field and should pass NULL if unused. -Steve