Logon Tracker also collects SSH events on Linux machines. The “LT Assigned Status” column reflects the status that Logon Tracker assigns to each event. These statuses are relevant to the module configuration (see Configuring Logon Tracker Agent Policy) and the UI search functionality (see Search Controls).
Note
For this release the Logon Tracker module collects only SSH related events.
Event Source | Type | LT Assigned Status | Description |
|---|---|---|---|
SSH | Password | SUCCESS | Indicates a successful SSH logon using a password. |
SSH | Password | FAILED | Indicates a failed SSH logon using a password. |
SSH | Public Key | SUCCESS | Indicates a successful SSH logon using a public key. |
SSH | Public Key | FAILED | Indicates a failed SSH logon using a public key. |
SSH | PAM | SUCCESS | Indicates a successful SSH logon. |
SSH | PAM | FAILED | Indicates a failed SSH logon. |
In order to collect the above events, Logon Tracker monitors the logs based on the Linux distribution.
Log File | Linux Distro |
|---|---|
/var/log/secure | Redhat and related distribution |
/var/log/auth.log | Debian and related distribution |
/var/log/messages | Remaining distribution |
Backfilled Event Timestamps
Depending on the configuration, Linux event timestamps may not include the year. To deduce the correct year for backfilled events, the last modified timestamp is used as a starting point. This is a best effort to determine the correct year for the events and may not be accurate in all cases.