From mboxrd@z Thu Jan 1 00:00:00 1970 From: Bill Tangren Subject: Re: (no subject) Date: Thu, 15 Mar 2007 17:15:04 -0400 Message-ID: <45F9B758.6010006@aa.usno.navy.mil> References: <954E3479CC27224785179CA04904214D054852F3@0668-its-exmp01.us.saic.com> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Return-path: Received: from mx2.redhat.com (mx2.redhat.com [10.255.15.25]) by int-mx2.corp.redhat.com (8.13.1/8.13.1) with ESMTP id l2FLF6G5026776 for ; Thu, 15 Mar 2007 17:15:07 -0400 Received: from beatrix.usno.navy.mil (beatrix.usno.navy.mil [198.116.61.254]) by mx2.redhat.com (8.13.1/8.13.1) with ESMTP id l2FLF5cl027082 for ; Thu, 15 Mar 2007 17:15:05 -0400 In-Reply-To: <954E3479CC27224785179CA04904214D054852F3@0668-its-exmp01.us.saic.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: "Kirkwood, David A." Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com Kirkwood, David A. wrote: > When I view the events related to xscreensaver for a locked screen I > get 2 separate audit entries, one for a failure and 1 as a success. Both > have the same uid, euid, etc. Actually, the entries are exactly the same > except for the event number and the success outcome. I have the > xscreensaver executable set -rwsr-xr-x. > > > > The failure may be due to xscreensaver not being able to write to the faillog, if you are using pam_tally (to implement three strikes and you are locked out), but I'm just guessing.