Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am using Debian squeeze and installed auditd on it.

When I run aureport it always shows Number of logins = 0 and Number of failed logins = 0.

What rule should be added in audit rules for recording these parameters?

share|improve this question

1 Answer 1

-w /var/log/faillog -p wa -k logins

-w /var/log/lastlog -p wa -k logins

the above two rules can help with watching logins .. wi capture both failed and successful logins

share|improve this answer
    
thanks. it was helpful –  chinmayv Apr 13 '12 at 6:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.