On Wed, 2007-03-07 at 08:52 +0530, Padmanabhan, Rajeesh (GE Healthcare) wrote:

Hi All,

I have setup syslog-ng 2.0.1 on both Solaris & linux. I noticed that, syslog-ng is not tracking root log out over ssh or telnet. But other normal user log outs are tracked properly. Please help me to know if any configuration change is required to audit this.

It is not up-to syslog-ng which events are logged, but rather it is up-to the applications running on the system. Login/logout actions are probably handled by PAM libraries, you need to check them to see why they don't log root login/logout. -- Bazsi