2

I have ran the following command on my RHEL 6 system to produce an audit report

aureport --login --summary -i

that produces the following output

Login Summary Report
============================
total  auid
============================
Warning - freq is non-zero and incremental flushing not selected.
458  unset
87  root

The command is said to generate a summary report of all failed login attempts per each system user according to this RHEL document.

However, wouldn't I need to use the --failed option to produce the output for failed login attempts?

Also, how is the output of this command to be interpreted? Does it mean 87 failed logins for root, or does 87 mean something else besides the number of failed logins?

2

From reading the documentation, I think using the "--failed" option would show only failed events for the report you're running. The default behavior is to show both failures and successes. From the man page:

--failed
       Only select failed events for processing in the reports. The default is both success and failed events.

I believe that the number is the number of events for that particular report for that particular user. In your case, there are 87 login events (failed and successful) associated with the user "root", and there are 458 login events (again, failed and successful) associated with the user "unset".

Here's some additional good reading on aureport:

  • thanks! I was quite confused since I only want failed and the link I put in says to show the number of "failed" run the command without --failed. – jgr208 Apr 5 '16 at 13:38
  • You could also run without the "--summary" flag to see a more detailed report, and that may lend some insight as to the summary. – Ryan Apr 5 '16 at 13:39
  • yea I did that but that is a whole another monster for trying to interpret that output, which is actually my next step in learning to audit. also why does a failed login for the root user appear under unset? – jgr208 Apr 5 '16 at 13:41
  • I'm not entirely sure why login events for root would appear under unset. What I meant in my answer was that the user "root" has 87 login events and that the user "unset" has 458 login events. I'll try to edit my answer to clarify that meaning. I linked to a separate unix.se question regarding events associated with the user "unset" in my answer. – Ryan Apr 5 '16 at 13:52
  • Ah yea I know that, I was just running a test to see if all failed logins were put under unset and not root. – jgr208 Apr 5 '16 at 14:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.