From: Steve Grubb <sgrubb@redhat.com>
To: linux-audit@redhat.com
Cc: Li Zhijian <zhijianli88@163.com>, Li Zhijian <lizhijian@cn.fujitsu.com>
Subject: Re: why no LOGOUT event record on some OSes
Date: Wed, 20 Oct 2021 13:05:20 -0400 [thread overview]
Message-ID: <3135484.aeNJFYEL58@x2> (raw)
In-Reply-To: <38b20678-b4f6-91c4-8743-775e7546641f@163.com>
Hello,
On Wednesday, October 20, 2021 10:55:02 AM EDT Li Zhijian wrote:
> I'm new to audit, then i observed that there is no LOGOUT event record
> in audit.log on my ubuntu 18.04 and debian 8 OSes, while the centos7.4 and
> fedora33 have it.
>
> I google it but get no answer, so am I missing something about the audit
> rules or special audit configuration ?
The logout events are hardwired into programs. IOW, they do not come from any
audit rules. You'd want to see which program the users login with. It is
responsible for sending the logout event. You might check the source code of
it or simply grep AUDIT_LOGOUT in the source.
If it is in the code, then you'd want to see what's happening in the code
when a user logs out.
-Steve
> Below are part of records of audit in my several OSes.
>
> debian 8
> lizhijian@lkp-bingo:~$ sudo aureport -e -i --summary | grep -i USER
> [sudo] password for lizhijian:
> 6 USER_START
> 6 USER_END
> 4 USER_ACCT
> 4 USER_CMD
> 2 USER_AUTH
> 2 USER_LOGIN
>
> ubuntu 18.04
> lizj@FNSTPC:~$ sudo aureport -e -i --summary | grep USER
> 43241 USER_END
> 16946 USER_START
> 16718 USER_ACCT
> 658 USER_AUTH
> 543 USER_CMD
> 255 USER_LOGIN
> 9 USER_ROLE_CHANGE
> 5 USER_ERR
> 2 USER_CHAUTHTOK
> 1 ADD_USER
>
> fedora 33
> [root@iaas-rpma linux]# aureport -e -i --summary | grep USER
> 7356 CRYPTO_KEY_USER
> 2103 USER_START
> 1649 USER_END
> 1268 USER_ACCT
> 1108 USER_ROLE_CHANGE
> 1029 USER_AUTH
> 895 USER_LOGIN
> 789 USER_LOGOUT
> 60 USER_CMD
> 14 USER_ERR
> 3 USER_MGMT
> 3 USER_CHAUTHTOK
> 1 ADD_USER
>
> Thanks
>
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://listman.redhat.com/mailman/listinfo/linux-audit
--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit
next prev parent reply other threads:[~2021-10-20 17:06 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-10-20 14:55 why no LOGOUT event record on some OSes Li Zhijian
2021-10-20 16:06 ` [EXT] " Wieprecht, Karen M.
2021-10-20 16:38 ` Richard Guy Briggs
2021-10-21 1:39 ` lizhijian
2021-10-21 12:38 ` Richard Guy Briggs
2021-10-20 17:05 ` Steve Grubb [this message]
2021-10-21 1:31 ` lizhijian
2021-10-21 3:56 ` lizhijian
2021-10-21 13:54 ` Andreas Hasenack
2021-10-22 7:18 ` lizhijian
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3135484.aeNJFYEL58@x2 \
--to=sgrubb@redhat.com \
--cc=linux-audit@redhat.com \
--cc=lizhijian@cn.fujitsu.com \
--cc=zhijianli88@163.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.