From: Steve Grubb <sgrubb@redhat.com>
To: linux-audit@redhat.com
Cc: Michael Folsom <mwfolsom@gmail.com>
Subject: Re: monitoring both logins and logouts via ssh
Date: Fri, 25 May 2007 08:54:40 -0400 [thread overview]
Message-ID: <200705250854.40375.sgrubb@redhat.com> (raw)
In-Reply-To: <ea5f6c090705241607y4db49839r9cef75695af8b456@mail.gmail.com>
On Thursday 24 May 2007 19:07:21 Michael Folsom wrote:
> Working with audit (ver=1.2.9) on SLES10 sp1 rc2 and wonder if it was
> possible to monitor both logins and logouts.
Logins are denoted by a USER_LOGIN event. There should also be a USER_START
event from the same tty/pty or host, auid, and pid. This marks the beginning
of a session. You should be able to look for a corresponding USER_END to
denote the end of a session. If USER_START results indicates a failure, there
will not be a USER_END.
> Currently my system is recording when a user logs in but not when they log
> out of a ssh session. Is this even possible?
With a little inference, its possible. I started to put in a USER_LOGOUT
event, but I decided its redundant when it can be inferred by the session
events.
-Steve
prev parent reply other threads:[~2007-05-25 12:54 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2007-05-24 23:07 monitoring both logins and logouts via ssh Michael Folsom
2007-05-25 12:54 ` Steve Grubb [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200705250854.40375.sgrubb@redhat.com \
--to=sgrubb@redhat.com \
--cc=linux-audit@redhat.com \
--cc=mwfolsom@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.