AUDIT_LOGIN vs AUDIT_USER_LOGIN
- First Post
- Replies
- Stats
-
Go to
- ----- 2024 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2023 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2022 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2021 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2020 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2019 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2018 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2017 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2016 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2015 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2014 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2013 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2012 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2011 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2010 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2009 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2008 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2007 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2006 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2005 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2004 -----
- December
- November
- October
- September
- August
I see AUDIT_USER_LOGIN when I ssh to a linux machine. What action will
cause AUDIT_LOGIN event?
--
Please Donate to www.wikipedia.org
Attachments:
- attachment.html (text/html — 311 bytes)
It just means Audit Login Context is set...
http://lxr.free-electrons.com/source/kernel/auditsc.c#L1991
I actually see that event when I ssh.
On Fri, Jul 31, 2015 at 9:59 AM, Satish Chandra Kilaru <iam.kilaru(a)gmail.com
wrote:
I see AUDIT_USER_LOGIN when I ssh to a linux machine. What action will
cause AUDIT_LOGIN event?
--
Please Donate to www.wikipedia.org
--
Please Donate to www.wikipedia.org
On Friday, July 31, 2015 09:59:13 AM Satish Chandra Kilaru wrote:
I see AUDIT_USER_LOGIN when I ssh to a linux machine.
This means an interactive login session has been started by the user. This is
in contract to a cron job which does not create this event.
What action will cause AUDIT_LOGIN event?
This means that the loginuid was set. Even a cron job will do this.
-Steve
Thank you.
On Fri, Jul 31, 2015 at 10:19 AM, Steve Grubb <sgrubb(a)redhat.com> wrote:
On Friday, July 31, 2015 09:59:13 AM Satish Chandra Kilaru wrote:
> I see AUDIT_USER_LOGIN when I ssh to a linux machine.
This means an interactive login session has been started by the user. This
is
in contract to a cron job which does not create this event.
> What action will cause AUDIT_LOGIN event?
This means that the loginuid was set. Even a cron job will do this.
-Steve
--
Please Donate to www.wikipedia.org
3431
days inactive
3431
days old
linux-audit@lists.linux-audit.osci.io
3 comments
2 participants
tags (0)
participants (2)
-
Satish Chandra Kilaru -
Steve Grubb