Q: C2 audit_event for ftp login/logfail

From: <FRANK_at_OSMIUM.LLNL.GOV>
Date: Fri, 21 Feb 1997 10:02:07 -0800 (PST)

Greetings,

We are running DU 4.0a & C2 security. I have reduced the
/etc/sec/audit_events list significantly and have just noticed
that I am not detecting ftp logins or logfails with the CDE audit
tool (dxaudit). Telnet and CDE logins and logfails are being
detected.

Ftp logins are being recorded in the /var/adm/wtmp (last).

Does anyone know which audit_event(s) affect the ftp events?

     Thanks for the help...
                            rich
                            rnfrank_at_llnl.gov
Received on Fri Feb 21 1997 - 19:24:15 NZDT