f2fdff
diff -urp Linux-PAM-1.1.8.orig/modules/pam_faillock/main.c Linux-PAM-1.1.8/modules/pam_faillock/main.c
f2fdff
--- Linux-PAM-1.1.8.orig/modules/pam_faillock/main.c	2014-10-16 10:12:57.117554380 -0400
f2fdff
+++ Linux-PAM-1.1.8/modules/pam_faillock/main.c	2014-10-16 10:38:00.199510093 -0400
f2fdff
@@ -141,10 +141,8 @@ do_user(struct options *opts, const char
f2fdff
 		if ((audit_fd=audit_open()) >= 0) {
f2fdff
 
f2fdff
 			if (pwd != NULL) {
f2fdff
-				snprintf(buf, sizeof(buf), "faillock reset uid=%u",
f2fdff
-					pwd->pw_uid);
f2fdff
-				audit_log_user_message(audit_fd, AUDIT_USER_ACCT,
f2fdff
-					buf, NULL, NULL, NULL, rv == 0);
f2fdff
+				audit_log_acct_message(audit_fd, AUDIT_USER_MGMT, NULL,
f2fdff
+					"faillock-reset", NULL, pwd->pw_uid, NULL, NULL, NULL, rv == 0);
f2fdff
 			}
f2fdff
 			close(audit_fd);
f2fdff
 		}
f2fdff
diff -urp Linux-PAM-1.1.8.orig/modules/pam_tally2/pam_tally2.c Linux-PAM-1.1.8/modules/pam_tally2/pam_tally2.c
f2fdff
--- Linux-PAM-1.1.8.orig/modules/pam_tally2/pam_tally2.c	2013-06-18 10:11:21.000000000 -0400
f2fdff
+++ Linux-PAM-1.1.8/modules/pam_tally2/pam_tally2.c	2014-10-16 10:37:05.072511717 -0400
f2fdff
@@ -997,9 +997,9 @@ main( int argc UNUSED, char **argv )
f2fdff
 #ifdef HAVE_LIBAUDIT
f2fdff
         char buf[64];
f2fdff
         int audit_fd = audit_open();
f2fdff
-        snprintf(buf, sizeof(buf), "pam_tally2 uid=%u reset=%hu", uid, cline_reset);
f2fdff
-        audit_log_user_message(audit_fd, AUDIT_USER_ACCT,
f2fdff
-                buf, NULL, NULL, ttyname(STDIN_FILENO), 1);
f2fdff
+        snprintf(buf, sizeof(buf), "pam_tally2 reset=%hu", cline_reset);
f2fdff
+        audit_log_acct_message(audit_fd, AUDIT_USER_MGMT, NULL,
f2fdff
+                buf, NULL, uid, NULL, NULL, ttyname(STDIN_FILENO), 1);
f2fdff
         if (audit_fd >=0)
f2fdff
                 close(audit_fd);
f2fdff
 #endif
f2fdff
@@ -1040,11 +1040,10 @@ main( int argc UNUSED, char **argv )
f2fdff
     }
f2fdff
     else if ( !cline_reset ) {
f2fdff
 #ifdef HAVE_LIBAUDIT
f2fdff
-      char buf[64];
f2fdff
       int audit_fd = audit_open();
f2fdff
-      snprintf(buf, sizeof(buf), "pam_tally2 uid=all reset=0");
f2fdff
-      audit_log_user_message(audit_fd, AUDIT_USER_ACCT,
f2fdff
-              buf, NULL, NULL, ttyname(STDIN_FILENO), 1);
f2fdff
+      audit_log_acct_message(audit_fd, AUDIT_USER_MGMT, NULL,
f2fdff
+              "pam_tally2-reset-all-accts reset=0", "*", -1,
f2fdff
+               NULL, NULL, ttyname(STDIN_FILENO), 1);
f2fdff
       if (audit_fd >=0)
f2fdff
               close(audit_fd);
f2fdff
 #endif