When I view the events related to xscreensaver for a locked screen  I
get 2 separate audit entries, one for a failure and 1 as a success. Both
have the same uid, euid, etc. Actually, the entries are exactly the same
except for the event number and the success outcome. I  have the
xscreensaver executable set -rwsr-xr-x. 

 

Thanks,

 

David A. Kirkwood