Hello, On my machine with audit 2.3.6 the following call to aulast is only displaying the "reboot" pseudo-users and not the actual logins:
ausearch --start this-month --raw | aulast --stdin Passing the "--bad" option to aulast, seems to correctly return the failed login attempt. Also, adding the login name to the aulast command doesn't seems to work at all even with the --bad option. OTOH, the aulastlog command seems to work as expected. An idea? Cheers, Laurent Bigonville -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
