Re: auditd not logging proper log.

Steve Grubb
2021-07-29T16:25:32Z

On Thursday, July 29, 2021 4:19:16 AM EDT Rakesh Kumar wrote:
> I did not get you, in kernel auditd is enabled like kauditd is running then
> what exactly we have to do changes in my system to get full login n log
> out info in audit. Log file.

Logging in/out is done in 2 places. First, pam records what it knows. But the
entry point daemon is also supposed to send USER_LOGIN and USER_LOGOUT
events.

Complete information is here:
https://github.com/linux-audit/audit-documentation/wiki/SPEC-User-Login-Lifecycle-Events

Gdm, Kdm, and sshd all have been updated to record these events. All that is
needed is to configure --with-audit during the package build. By now, I would
expect all distros to do that.

-Steve

> On Sat, Jul 10, 2021 at 19:57, Steve Grubb<sgrubb@redhat.com> wrote: On
Saturday, July 10, 2021 2:28:55 AM EDT Rakesh Kumar wrote:
> > 1)I am trying to run the auditd (start/stop) without root user as normal
> > user , how to achieve this on linux.?
>
> For security reasons, this is not allowed.
>
> > 2)i am using kernel version 4.19.97 and i am not getting any
> > login/logout,
> > authentication fail/pass log data in audit.log file. DOes it need any
> > changes in the config or rules..
>
> This is hardwired into pam. The rules don't matter. I'd check that pam was
> compiled with audit support and that audit is enabled in the kernel.
>
> -Steve