audit_log_user_message question

[Steve Grubb]

On Tuesday 27 May 2008 13:56:03 LC Bruzenak wrote:
> In looking at the user application audit I'm wondering why there is a
> "hostname" field there?

So that apps like sshd can say where the user is coming from.


> I understand the obvious answer but would think I'd trust the auditd or
> audispd more than an application for the hostname answer, and those
> would be consistent.

That's a different hostname. :)

The hostname field as used in audit_log_user_message would be a remote machine 
name and not the local address. Many apps do not need this field and should 
pass NULL if unused.

-Steve