Re: Audit Prelude Logout Tracking

[LC Bruzenak <lenny@magitekltd.com>]

On Thu, 2009-02-19 at 09:26 -0500, Dan Gruhn wrote:
> 
> LC Bruzenak wrote:
> > On Wed, 2009-02-18 at 16:44 -0600, LC Bruzenak wrote:
> >   
> LCB,
> 
> Thanks for the tip on the hostname/addr info is only for remote access 
> information.
> 
>  Although this seemed like the right place to look, I don't see 
> USER_LOGOUT events in my audit logs, this is why I mentioned the 
> USER_END events.  Do you remember USER_LOGOUT working back when you 
> tried before?

I thought that is what I saw previously, but it isn't there now. 
Only login/logout on the console gives these messages. 
I need to go back through some old email - I thought Steve patched this
a while back.

> 
> I am interested in the patches that you make to audisp-prelude.c.  Do 
> you think they might be useful to me in my NISPOM quest?  If so, are 
> they patches from 1.7.11 and could you send me a copy?

I'll gladly send you a copy off-list - the changes are specific to what
I'm doing. Basically I had to sub-format the user text in order to key
off what I wanted to send to prelude. 

You may need to incorporate something similar...unless of course between
us we can provide a non-intrusive patch Steve would accept which would
accommodate user-designated IDS events! :)

LCB.

-- 
LC (Lenny) Bruzenak
lenny@magitekltd.com