|Alert Message||failed adding user to system|
Note: ASL does not cause this event to occur, it simply reports when another application is causing this to occur.
This event reports when the operating system, or an application, has been instructed to add a user and has failed to do add this user. This event is not caused by ASL, ASL simply reports when this event occurs.
 Log example
hostname useradd: failed adding user 'zabbix', data delete
 False Positives
The rule itself can not generate a false positive, the rule just reports when this event occurs.
 Tuning Guidance
We do not recommend you disable this rule. Disabling this rule will not prevent this event from occuring, but will prevent ASL from reporting when it occurs and may effect ASLs ability to correlate events that may indicate an attack is under way.
 Additional Information
 Similar Rules
 Knowledge Base Articles
 Outside References