Hey everyone!
Is there a table of event code logs for RHEL? That is similar to this Windows table?
Event # | Log | Description |
1102 | Security | Audit log – indicates the Security Log was cleared |
4620 | Security | Account Creation |
4624 | Security | Account Logon indicator (Logon Type 10 indicates RDP connection. If paired with Ev# 4672 – proves admin account logged into system |
4625 | Security | Failed Logon |
4648 | Security | Authentication using explicit (different) credentials. RUNAS event |
4672 | Security | Account logon with super user privileges |
4697 | Security | New service installed |
4698, 4699 | Security | Scheduled Task created |
4700, 4701 | Security | Scheduled Task enabled |
4722 | Security | User account enabled |
4772 | Security | Privileged Account usage |
4778 | Security | Remote Session Reconnected |
4779 | Security | Remote Session Disconnected |
4800 | Security | Workstation Locked |
4801 | Security | Workstation Unlocked |
