You must configuring the registry to enable logging from LDAP and secure workstation.
To log events from SecureLogin LDAP authentication module:
Create a registry value at HKEY_LOCAL_MACHINE\Software\Novell\Login\Ldap
The following events are logged:
Event ID 1 Informational: NSL user login
Event ID 2 Informational: LDAP user password change
Event ID 3 Warning: Workstation unlocked by different User
Open the nslevtsvc.ini file in a text editor, and add the following section about the new information source:
[wmi]
event_source=LDAPAuth
The following events are logged:
Event ID 1 Informational: NSL user login
Event ID 2 Informational: LDAP user password change
Event ID 3 Warning: Workstation unlocked by different User
To log events from Secure Workstation:
Create a registry of DWORD value called SWAudit at HKEY_LOCAL_MACHINE\Software\Novell\ NMAS\MethodData\Secure Workstation.
Set the DWORD value to 1.
Open the nslevtsvc.ini file in a text editor, and add the following section about the new information source:
[wmi]
event_source=SecureWorkstation
Following events are logged:
Event ID 4 Informational: Inactivity Timeout
Event ID 5 Informational: Device Removal
Event ID 6 Informational: Manual Lock event