search for: 327846

This is.... odd. We're seeing a *lot* of sshd[8400]: Timeout, client not responding. So I'm trying to find out whose client is having issues. Trying to figure that, after processes are gone, I tried looking in lastlog, which is where it gets odd. lastlog shows root coming in, and it shows a security account coming in... years ago. I see one of our users logging in a goodly number of

...n what last shows. A nice tip is to pipe the output through another tool to convert the timestamps to human readable date and time. tail -f /var/log/audit/audit.log | ausearch -i or tail -f /var/log/audit/audit.log | perl -pe 's/(\d+)/localtime($1)/e' via https://serverfault.com/questions/327846/convert-selinux-log-date-format-from-epoch-to-normal