added Failed Login auditing

trellix-enterprise · Feb 7, 2015 · de39080 · de39080
1 parent 9d66bfb
commit de39080
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/audit_plugin.cc b/src/audit_plugin.cc
@@ -224,7 +224,7 @@ static void audit(ThdSesData *pThdData)
   if (record_logins_enable) {
       const char * cmd = pThdData->getCmdName();
       const char * user = pThdData->getUserName();
-      if (!strcasecmp(cmd, "Connect") || !strcasecmp(cmd, "Quit")) {
+      if (!strcasecmp(cmd, "Connect") || !strcasecmp(cmd, "Quit") || !strcasecmp(cmd, "Failed Login")) {
          if(user && strlen( user))
          	Audit_handler::log_audit_all(pThdData);    
          return;