Home / server / Questions / 582391
In Process
lacrosse1991
Asked: 2014-03-16 22:03:35 +0800 CST

is this normal behavior for pam_tty_audit

  • 772

I've recently configured pam_tty_audit, and while it does log information, it seems like it does not log information until after the user has logged out. Oddly enough, it does log some things live, for instance, if I ran "nano hello", it would log "nano" without the argument, but if I were log out and log back, "nano hello" would then show up in the auth log. Please see below for an example of what I am talking about

  1. 16/03/14 07:01:05 113 0 ? 57 nano <^X> (user logs out and then in again)
  2. 16/03/14 07:01:12 116 0 ? 57 bash ,,"nano hello",,,,

Is this normal behavior for pam tty audit?

security

1 Answers

  1. According top this blog post what you're seeing is correct for unprivileged users whose records are logged only when they log out or a certain number of characters are collected.

    Privileged accounts are logged immediately.

    • 1