Audit.log is reporting acct=(unknown) for ssh attempt
Issue
When attempting to ssh with an unknown/invalid user name, /var/log/audit/audit.log reports acct=(unknown).
Environment
- Red Hat Enterprise Linux 6
- pam
- auditd
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.
