Auditd can create /var/log/audit
Initial password agent policy module