Re: audit_log_user_message question

Steve Grubb
2008-05-27T18:01:51Z

On Tuesday 27 May 2008 13:56:03 LC Bruzenak wrote:
> In looking at the user application audit I'm wondering why there is a
> "hostname" field there?

So that apps like sshd can say where the user is coming from.

> I understand the obvious answer but would think I'd trust the auditd or
> audispd more than an application for the hostname answer, and those
> would be consistent.

That's a different hostname. :)

The hostname field as used in audit_log_user_message would be a remote machine
name and not the local address. Many apps do not need this field and should
pass NULL if unused.

-Steve