USER_MGMT event
Steve Grubb
sgrubb at redhat.com
Sat Jan 4 21:11:49 UTC 2020
On Monday, December 30, 2019 12:29:13 PM EST MAUPERTUIS, PHILIPPE wrote:
> On a RHEL8 server, when playing around with usermod and chsh, I noticed
> that usermod -c 'root at xxx' root generates a user_mgmt event
> But
> chsh -s /usr/bin/tlog-rec-session root didn't.
> Is that the expected behavior ?
It depends. Did you get any event at all? There is a chance that you just
have mismatching events.
> I was expecting an event for both.
There should be an event for both.
> Should I open a ticket at redhat for this ?
Let's see what the answer is for the above. But potentially yes. And if there
is any change we'll be sure to get this into upstream shadow-utils so its
uniform across all distros.
-Steve
More information about the Linux-audit
mailing list