From: Steve Grubb <sgrubb@redhat.com>
To: linux-audit@redhat.com, weber@zbfmail.de
Subject: Re: gentoo auditd not logging?
Date: Mon, 27 Oct 2014 09:06:59 -0400 [thread overview]
Message-ID: <25263825.Gqr2hZfEHP@x2> (raw)
In-Reply-To: <4e30e7a80cdb5f56f082f81a707c23a9@zbfmail.de>
On Friday, October 24, 2014 03:15:39 PM Marko Weber | 8000 wrote:
> i installed audit on a gentoo box.
> in the auditd.log it shows logins via ssh:
>
> type=LOGIN msg=audit(1413987302.466:14): pid=27091 uid=0
> old-auid=4294967295 auid=0 old-ses=4294967295 ses=7 res=1
>
> but in the logs i cant see failed logins.
Actual failed logins would be a USER_LOGIN event. You should be able to run
aureport --start today --login --failed
to see them. Note that auditd is about like syslog in that it does not
generate events, it records them. You may need to add --enable-audit when
building a number of packages to get the right support in place.
-Steve
prev parent reply other threads:[~2014-10-27 13:06 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-10-24 13:15 gentoo auditd not logging? Marko Weber | 8000
2014-10-27 13:06 ` Steve Grubb [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=25263825.Gqr2hZfEHP@x2 \
--to=sgrubb@redhat.com \
--cc=linux-audit@redhat.com \
--cc=weber@zbfmail.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox