Do you have the appropriate audit event in /etc/security/audit_event? It
should have the following entry:

32800:AUE_openssh:OpenSSH login:lo

Prior to the BSM patch being included with OpenSSH, the patch included a
file called show-audit.c that you can compile to help troubleshoot audit
issues. I haven't downloaded 4.x yet, so I don't know if it is included.



On Tue, 15 Mar 2005, Dave Markham wrote:

> I have come across an error with crontabs if you have ssh'd to a machine
> and edited the crontab if you have BSM auditing enabled on solaris.
> There was a work around in the sshd_config to change UseLogin to yes,
> the problem is this stops X forwarding.
> Does anyone know if this problem has been rectified in Openssh 4 ? I am
> running BSM auditing on Solaris 8 and currently running openssh 3.9 and
> connecting with Putty.
> Cheers
> Dave