Record Attempts to Alter Logon and Logout Events The audit system already collects login info for all users and root. To watch for attempted manual edits of files involved in storing logon events, add the following to '/etc/audit/audit.rules': '-w /var/log/faillog -p wa -k logins -w /var/log/lastlog -p wa -k logins'

Manual editing of these files may indicate nefarious activity, such as an attacker attempting to remove evidence of an intrusion. Fix: No Remediation Info