Re: audit_log_user_message question

LC Bruzenak
2008-05-27T18:06:01Z

On Tue, 2008-05-27 at 14:01 -0400, Steve Grubb wrote:
> On Tuesday 27 May 2008 13:56:03 LC Bruzenak wrote:
> > In looking at the user application audit I'm wondering why there is a
> > "hostname" field there?
>
> So that apps like sshd can say where the user is coming from.
>
>
> > I understand the obvious answer but would think I'd trust the auditd or
> > audispd more than an application for the hostname answer, and those
> > would be consistent.
>
> That's a different hostname. :)

Right!
Sorry; I promise I'll get it one of these days.
>
> The hostname field as used in audit_log_user_message would be a remote machine
> name and not the local address. Many apps do not need this field and should
> pass NULL if unused.
>
> -Steve

Thanks again,