1) os: aix 7
2) ca CotrolMinder: 12.81
3) Not logged failed logins at seos.audit on the endpoint.
Are you using pam ? PAM seos is used to detect login failures.
I would recommend you to open a normal case in support so we can help you to configure.
Thank you, Merce
actually i don't even know to open a case.
What is the output of "sewhoami" after you login with the same user with correct credentials?
Also double check what is the Audit mode set for the user and the terminal from which the user is performing the login?
Thanks and Regards,
user's audit mode is default set with login-success, login-failure, failure.
Have you applied or upgraded to CF3 or SP1 yet ?
CA ControlMinder 12.8.01 FIXLIST - CA ControlMinder - 12.8.01 - CA Technologies Documentation
Please see if following symptom is applicable for your case.
Fixes an issue with seagent where a corrupted seos.audit file with an empty space fails to retrieve events. As a result, the number of records that are seen through the Enterprise Management UI is different from the number of records that are seen through "seaudit -a".
Did the answers from Merce and Reatesh help you? Can you please provide answers to their questions or let us know if you have opened a Support Case?
Retrieving data ...