/var/log/audit/audit.log
type=CRED_ACQ type=CRED_DISP type=CRED_REFR type=CWD type=LOGIN type=PATH type=PROCTITLE type=SYSCALL type=USER_ACCT type=USER_END type=USER_START
bastion.log
auditctl, /var/log/audit/audit.log
Advertising: