What were you trying to do that didn't work?
Post RHEL-8.6 and with gdm-40, following USER_LOGIN messages not seen in audit when loggin in via GUI :
type=USER_LOGIN msg=audit(1690426947.800:126): pid=3091 uid=0 auid=0 ses=4 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=0 exe="/usr/libexec/gdm-session-worker" hostname=? addr=? terminal=? res=success'
Please provide the package NVR for which bug is seen:
gdm-40.0-27.el8
How reproducible:
Always when logging in via GUI
Steps to reproduce
- Install RHEL-8.6 with gdm-40 or later
- Try logging in via GUI ( not ssh )
- Check audit logs ( /var/log/audit/audit.log ) for USER_LOGIN messages
Expected results
USER_LOGIN messages should be logged
Actual results
USER_LOGIN messages are not logged