USER_MGMT event

Steve Grubb sgrubb at redhat.com
Sat Jan 4 21:11:49 UTC 2020


On Monday, December 30, 2019 12:29:13 PM EST MAUPERTUIS, PHILIPPE wrote:
> On a RHEL8 server, when playing around with usermod and  chsh, I noticed
> that usermod -c 'root at xxx' root generates a user_mgmt event
> But
> chsh -s /usr/bin/tlog-rec-session root didn't.
> Is that the expected behavior ?

It depends. Did you get any event at all? There is a chance that you just 
have mismatching events. 

> I was expecting an event for both.

There should be an event for both.

> Should I open a ticket at redhat for this ?

Let's see what the answer is for the above. But potentially yes. And if there 
is any change we'll be sure to get this into upstream shadow-utils so its 
uniform across all distros.

-Steve





More information about the Linux-audit mailing list