I have a need to set up an audit rule that will track whenever a user's screensaver is unlocked via password. I've tried setting a watch on pam_sss.so but that gets a lot more than what I strictly need and that also, strangely, had a tendency to audit when the screensaver was activated but not when it was deactivated.
Has anyone done this successfully in a way that can be shared? Our users are on both gnome & kde and could potentially be using one of several screensavers.
Thanks,
freeipa-users@lists.fedorahosted.org