[syslog-ng] root logout is not tracked by syslog-ng

[Balazs Scheidler]

On Wed, 2007-03-07 at 08:52 +0530, Padmanabhan, Rajeesh (GE Healthcare)
wrote:
> Hi All,
>  
> I have setup syslog-ng 2.0.1 on both Solaris & linux. I noticed that,
> syslog-ng is not tracking root log out over ssh or telnet. But other
> normal user log outs are tracked properly.
> Please help me to know if any configuration change is required to
> audit this.

It is not up-to syslog-ng which events are logged, but rather it is
up-to the applications running on the system.

Login/logout actions are probably handled by PAM libraries, you need to
check them to see why they don't log root login/logout.

-- 
Bazsi