monitoring both logins and logouts via ssh

monitoring both logins and logouts via ssh

[Michael Folsom]

Hi:

Working with audit (ver=1.2.9) on SLES10 sp1 rc2 and wonder if it was
possible to monitor both logins and logouts.   Currently my system is
recording when a user logs in but not when they log out of a ssh
session.  Is this even possible?


Thanks -


Michael

Re: monitoring both logins and logouts via ssh

[Steve Grubb]

On Thursday 24 May 2007 19:07:21 Michael Folsom wrote:
> Working with audit (ver=1.2.9) on SLES10 sp1 rc2 and wonder if it was
> possible to monitor both logins and logouts.

Logins are denoted by a USER_LOGIN event. There should also be a USER_START 
event from the same tty/pty or host, auid, and pid. This marks the beginning 
of a session. You should be able to look for a corresponding USER_END to 
denote the end of a session. If USER_START results indicates a failure, there 
will not be a USER_END.

> Currently my system is recording when a user logs in but not when they log
> out of a ssh session.  Is this even possible?

With a little inference, its possible. I started to put in a USER_LOGOUT 
event, but I decided its redundant when it can be inferred by the session 
events.

-Steve