AUE_logout

Log Out (Cerrar sesión)

Este evento se genera cuando una llamada cierra la sesión del usuario actual a través de la interfaz de usuario o la línea de comandos.

Log Level (Nivel de registro)

1

Requiere ajuste detallado.

Sí

Ejemplo de AUE_logout

Este es un ejemplo de registro de telemetría para un evento de cierre de sesión.

{
  "exec_chain": {
    "uuid": "6C3FCAFB-0FFE-4E12-B542-AE7D7BB8B174"
  },
  "exec_chain_child": {
    "parent_path": "/sbin/launchd",
    "parent_pid": 1,
    "parent_uuid": "CC072B43-6C9B-4D02-8186-AF437A57A437"
  },
  "header": {
    "time_seconds_epoch": 1657903014,
    "time_milliseconds_offset": 133,
    "version": 11,
    "event_modifier": 0,
    "event_id": 6153,
    "event_name": "AUE_logout"
  },
  "host_info": {
    "serial_number": "C03WG0H4HDTS",
    "host_name": "Test_MacBook_Pro",
    "osversion": "Version 12.4 (Build 21F79)",
    "host_uuid": "8891C1E2-0AC0-4E4A-844B-EA491B14D115"
  },
  "identity": {
    "signer_id": "com.apple.sessionlogoutd",
    "team_id_truncated": false,
    "signer_id_truncated": false,
    "cd_hash": "e3ef8507737377e0b5a8606b2320f189de9ba270",
    "team_id": "",
    "signer_type": 1
  },
  "key": "03AD14D2-0A48-4D91-A207-21D52B842A8B",
  "return": {
    "error": 0,
    "description": "success",
    "return_value": 0
  },
  "subject": {
    "session_id": 9742,
    "group_id": 20,
    "process_name": "/System/Library/CoreServices/sessionlogoutd",
    "parent_pid": 1,
    "effective_user_name": "root",
    "user_id": 501,
    "group_name": "staff",
    "parent_uuid": "CC072B43-6C9B-4D02-8186-AF437A57A437",
    "uuid": "6C3FCAFB-0FFE-4E12-B542-AE7D7BB8B174",
    "effective_group_id": 0,
    "process_hash": "a4f2bd70185c1a49429151c5d9fd08bb5e65fe83",
    "audit_id": 501,
    "responsible_process_id": 9742,
    "parent_path": "/sbin/launchd",
    "process_id": 9742,
    "effective_group_name": "wheel",
    "audit_user_name": "jamf",
    "effective_user_id": 0,
    "terminal_id": {
      "type": 4,
      "ip_address": "0.0.0.0",
      "port": 50331650
    },
    "responsible_process_name": "/System/Library/CoreServices/sessionlogoutd",
    "user_name": "jamf"
  }
}