Login/Logout audit events and user info

[mm666]

I'm trying to find a way to collect information about users' names or uids who are logging in and logging out. I'm running supraudit with a grep I found on GitHub https://github.com/AlfredoAbarca/OSXMon/blob/master/opt/SupraFilters_Login.sh

I can get such records:

Code: Select all

(text=Verify password for record type Users 'admin' node '/Local/Default' ) = 0
(text=Verify password for record type Users 'foo' node '/Local/Default' ) = 5000

Can I assume that AUE_auth_user event always returns "0" on successful login and "5000" in other cases? Is there maybe another login event where I can get uid instead of looking for username in text?

Can I use some event to record which user logged out? Events around logout which I found, contain neither username nor uid.