auid doesn't display user id while connected via ssh

Solution Verified - Updated -

Issue

  • When a user login via ssh to the system and execute "sudo su -" then uid doesn't come in auid field under audit logs.
type=CRED_ACQ msg=audit(1322878406.113:62654963): user pid=20204 uid=0 auid=4294967295 msg='PAM: setcred acct="root" : exe="/usr/bin/sudo" (hostname=u060tsi41, addr=127.0.0.1, terminal=/dev/pts/2 res=success)'
type=USER_START msg=audit(1322878406.117:62654964): user pid=20204 uid=0 auid=4294967295 msg='PAM: session open acct="root" : exe="/usr/bin/sudo" (hostname=u060tsi41, addr=127.0.0.1, terminal=/dev/pts/2 res=success)'
type=USER_END msg=audit(1322878406.117:62654965): user pid=20204 uid=0 auid=4294967295 msg='PAM: session close acct="root" : exe="/usr/bin/sudo" (hostname=u060tsi41, addr=127.0.0.1, terminal=/dev/pts/2 res=success)'
type=USER_CMD msg=audit(1322878406.118:62654966): user pid=20204 uid=0 auid=4294967295 msg='cwd="/home/sh53837" cmd=2F62696E2F7375202D (terminal=pts/2 res=success)'
type=USER_AUTH msg=audit(1322878406.120:62654967): user pid=20204 uid=0 auid=4294967295 msg='PAM: authentication acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
type=USER_ACCT msg=audit(1322878406.121:62654968): user pid=20204 uid=0 auid=4294967295 msg='PAM: accounting acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
type=USER_START msg=audit(1322878406.124:62654969): user pid=20204 uid=0 auid=4294967295 msg='PAM: session open acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
type=CRED_ACQ msg=audit(1322878406.124:62654970): user pid=20204 uid=0 auid=4294967295 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'

Environment

  • Red hat Enterprise Linux 5

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content