On Wed, Jun 26, 2013 at 10:33:36AM +0530, Shinoj Gangadharan wrote: If this is what I think you are seeking, what you are seeking is not in auditd. Are you talking about this?: https://bugzilla.redhat.com/show_bug.cgi?id=725100 https://bugzilla.redhat.com/show_bug.cgi?id=966166 https://bugzilla.redhat.com/show_bug.cgi?id=976033 If so, the kernel bits are in upstream v3.10-rc1. They are in the process of being backported to rhel6.5. The userspace bits are in upstream pam, but I've just discovered that is broken. I have a patch to fix it, which I'm about to submit, but I just have to verify it. I am also in the process of backporting the original patch with fix to rhel6.5. - RGB -- Richard Guy Briggs <rbriggs(a)redhat.com&gt; Senior Software Engineer Kernel Security AMER ENG Base Operating Systems Remote, Ottawa, Canada Voice: +1.647.777.2635 Internal: (81) 32635 Alt: +1.613.693.0684x3545