5.3.11 Collect Login and Logout Events '/var/log/tallylog'
Information
Configuration Level : Level-II
Solution
Add the following lines to the /etc/audit/audit.rules file. -w /var/log/faillog -p wa -k logins -w /var/log/lastlog -p wa -k logins -w /var/log/tallylog -p wa -k logins -w /var/log/btmp -p wa -k session Execute the following command to restart auditd pkill -P 1-HUP auditd