On Monday, January 12, 2015 12:12:02 PM Burak Gürer wrote:
> we have some linux servers and a central log collector system. we are
> sending audit logs to this log system. this log collector system can
> parse such logs but this system confused at lines with "auid=4294967295"
> in audit logs.
auid
Hi Steve,
thanks for your assistance,
For RHEL5, I know its enabled. But based on your questions above, you are
asking 2 things. Where to put audit=1 and if pam_loginuid is right. For these,
# cat /proc/cmdline
and
# cat /proc/self/loginuid
would let you check. In the first, make sure audit
