4.1.9 Ensure session initiation information is collected - btmp - auditctl
Information
Monitoring these files for changes could alert a system administrator to logins occurring at unusual hours, which could indicate intruder activity (i.e. a user logging in at a time when they do not normally log in).
Solution
Add the following lines to the /etc/audit/audit.rules file: -w /var/run/utmp -p wa -k session -w /var/log/wtmp -p wa -k session -w /var/log/btmp -p wa -k session