Hi, I have found that auditd in default configuration does not store user IDs in the logs if the account is LDAP based.
praudit says only: header,32,2,su,,server,2010-06-29 15:56:24.284 +02:00,return,success,0 In case of local users it says: ,subject,estibi,root,root,root,root,8416,1677303986,6456 71168 10.1.1.10,return,success,0 -- Piotr Jasiukajtis | estibi | SCA OS0072 http://estseg.blogspot.com _______________________________________________ security-discuss mailing list [email protected]
