aulast only displaying reboot pseudo-users

Eric Paris eparis at redhat.com
Tue Jun 17 15:26:01 UTC 2014


On Tue, 17 Jun 2014 10:56:24 -0400
Steve Grubb <sgrubb at redhat.com> wrote:

> On Tuesday, June 17, 2014 10:31:25 AM Eric Paris wrote:
> > On Tue, 17 Jun 2014 16:09:32 +0200

> > 2) Userspace silently throws records which are 'malformed' away,
> > instead of just printing them...
> > 
> > ausearch -m LOGIN should be able to display these things...
> 
> It does not have a concept of completing
> search criteria and just dumping the record out. There might be
> something that can be done here, but lots a changes risks breaking
> things in subtle ways.

I understand, but I can't imagine any customer that would want these
records silently thrown away.  When grep is a more reliable tool, we're in
trouble   :)




More information about the Linux-audit mailing list