Capybara
Cadet
Cadet
  • 272 Views

RHEL event code log

Hey everyone! 

Is there a table of event code logs for RHEL? That is similar to this Windows table? 

Event #

Log

Description

1102

Security

Audit log – indicates the Security Log was cleared

4620

Security

Account Creation

4624

Security

Account Logon indicator (Logon Type 10 indicates RDP connection.  If paired with Ev# 4672 – proves admin account logged into system

4625

Security

Failed Logon

4648

Security

Authentication using explicit (different) credentials.  RUNAS event

4672

Security

Account logon with super user privileges

4697

Security

New service installed

4698, 4699

Security

Scheduled Task created

4700, 4701

Security

Scheduled Task enabled

4722

Security

User account enabled

4772

Security

Privileged Account usage

4778

Security

Remote Session Reconnected

4779

Security

Remote Session Disconnected

4800

Security

Workstation Locked

4801

Security

Workstation Unlocked

0 Kudos
0 Replies
Join the discussion
You must log in to join this conversation.