a2o/snoopy — pull request #7 by tmalkowski (2014-09-11 19:23:47+00:00)
Title: Log owner of current tty

Added UID of current TTY, as a means of tracking actual user ID as opposed to current user ID.

In effect, this matches the behavior seen with the "auid" field in auditd -- although this isn't guaranteed to be accurate, I can't come up with a normal workflow where this doesn't match.

I had considered setting tty_uid to -1 when no TTY device is present, but if tty field is blank, it seems pretty apparent that tty_uid would also be meaningless.