An attacker might attempt to log in as an authorized user, through stolen credentials, unpatched exploits, or brute force attempts to guess a valid username and password. If a user is attempting to log in to a system at an unusual time, or if there are many failed attempts, there is a possibility that the system is the target of an attack. Auditing logon events mitigates this risk by recording all logon attempts, successful and unsuccessful, to the system.

[yes/no]

To make sure the appropriate flags are enabled for auditing, run the following command: sudo sed -i.bak '/^flags/ s/$/,aa/' /etc/security/audit_control; sudo audit -s You may also edit the /etc/security/audit_control file using a text editor to define the flags your organization requires for auditing.