AUDIT_LOGIN vs AUDIT_USER_LOGIN

[Steve Grubb]

On Friday, July 31, 2015 09:59:13 AM Satish Chandra Kilaru wrote:
> I see AUDIT_USER_LOGIN when I ssh to a linux machine. 

This means an interactive login session has been started by the user. This is 
in contract to a cron job which does not create this event.

> What action will cause AUDIT_LOGIN  event?

This means that the loginuid was set. Even a cron job will do this.

-Steve