Making audit report using "aureport" results auid = -1 in all events
Issue
- searching "aureport" on auid = -1 results in all events
- ureport -m --success
Account Modifications Report
=================================================
# date time auid addr term exe acct success event
=================================================
1. 04/29/2012 13:24:09 -1 ? pts/0 /usr/sbin/useradd ? yes 93490
2. 04/29/2012 13:24:09 -1 ? pts/0 /usr/sbin/useradd ? yes 93491
3. 04/29/2012 13:35:43 -1 ? pts/0 /usr/sbin/useradd ? yes 93585
4. 04/29/2012 13:35:43 -1 ? pts/0 /usr/sbin/useradd ? yes 93586
Environment
- Red Hat Enterprise Linux 5.8
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.
