- it can be confirmed with audit records, using ausearch or reviewing the /var/log/audit/audit.log files (even with using grep),
- it can be confirmed reviewing the /var/log/messages file,
What would cause this? Do we need to take some corrective action to improve visibility into whatever is happening on our systems?