audit doesn't seem to be working correctly.

[dexterclarke at Safe-mail.net]

> Well,
> 
> The problem that I thought was there, wasn't actually there,
> which is why I said to ignore the patch :)
> 
> I've tried to reproduce the problems you are seeing but
> I have not been able to.
> 
> So far I've tried on -CURRENT and RELENG_6. We are aware
> of some issues on RELENG_6_2 specifically with !i386
> architectures (i.e. amd64, sparc64 etc).
> 
> Is it possible you can send me:
> 
> (1) The output to uname -a
> (2) Your /etc/security directory
> (3) How are you logging in to this machine, SSH? Telnet?
> 
> (3) is important because the login program will be responsible
> for setting up the audit ID and preselection masks.
> 
> Hopefully with this information, we can get to the bottom of this.
> 

I've been without connectivity for a few days but am now back,
with good news.

I believe that the problem was actually down to the fact that the
user being audited had not logged out and in again after the audit
settings changed.

I think this is just a documentation bug - the audit docs never
mention explicitly that the login program handles preselection.
It seems to be working properly now that the system has been
rebooted (forcing new logins for all users).

--
dc