On Wednesday 07 November 2007 15:35:00 Zachary Shay wrote: This is done automatically for you as long as the audit system is enabled. Changing the loginuid generates this record: type=LOGIN msg=audit(1194465501.865:7462): login pid=9651 uid=0 old auid=4294967295 new auid=500 But just because a loginuid (auid) was changed does not mean that a login occurred. For example, cron sets the auid when it runs a script on behalf of a user. In that case, no one logged in. To distinguish actual logins from other loginuid changes, the entry point daemons have been modified to send a USER_LOGIN event right after the pam_session would have been attempted to be started. These events look like this: type=USER_LOGIN msg=audit(1194448956.798:186): user pid=2261 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=localhost, addr=127.0.0.1, terminal=:0 res=success)' No, its hardwired so you don't have anything to configure for this kind of event. You can suppress this with a rule if you didn't want it. -Steve