monitoring both logins and logouts via ssh in SLES10 SP1 RC2

[Steve Grubb]

On Friday 25 May 2007 13:21, Michael Folsom wrote:
> Did a little test on a X86-64 SLES10 SP1 RC2 system - sshed into in
> and did see the USER_LOGIN line then got out via either an exit or
> logout and never see an USER_END statement. 

If I remember correctly, there was a bug in a patch to sshd that called 
pam_session_close from the unprivileged process. I think we moved this and 
sent the patch upstream.

> Could this be an issue in Suse's implementation of audit?

There might be a sshd patch that needs backporting from openssh cvs.

-Steve