I can't find ubuntu sucessful authentication log

splk_user — Wed, 12 Jul 2023 11:29:05 GMT

Hi!

i have configred ubuntu machine to send authentication log to my splunk instance using syslog.

But i found just the failed auth logs and other logs with the field " pam_unix(cron:session)".

i am looking for the successful authentication that have the field "pam_unix(login:session)" and i find just pam_unix(sudo:session)

Do i need to use add-on for unix and linux ?

Any advice, tips, or resources you can provide will be highly appreciated

Thank you

topic I can't find ubuntu sucessful authentication log in Getting Data In