[ossec-dev] [Bug 86] New: Add decoder for pam-ssh logout

[ossec-bugzilla@xxxxxxxxxxxxxxxxxxxxxxxxxxx]

http://www.ossec.net/bugs/show_bug.cgi?id=86

           Summary: Add decoder for pam-ssh logout
           Product: OSSEC
           Version: 1.3
          Platform: PC
        OS/Version: Linux
            Status: NEW
          Severity: enhancement
          Priority: P1
         Component: Signatures
        AssignedTo: ossec-dev@xxxxxxxxx
        ReportedBy: brownoxford@xxxxxxxxx


A decoder called pam-user exists to decode lines like:

Oct  9 15:22:02 hal sshd[894]: pam_unix(sshd:session): session opened for user
dave by (uid=0)

Add a decoder for the corresponding logouts:

Oct  9 15:28:09 hal sshd[894]: pam_unix(sshd:session): session closed for user
dave


-- 
Configure bugmail: http://www.ossec.net/bugs/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.