script help

[KPS]

Hi Gurus,

Looking a script to do the following:

I'd like to be able to go through the syslog and capture when anyone user does an
su - klxprod.

I'd also like to to be able to put the output of the above SU activity within the the following field format if at all possible, like the following 2 examples.

SU 07/23 22:01 + tty?? root-klxprod
SU 07/20 09:14 + ta jsmith-klxprod John Smith


Can someone please help?

-KPS

[Rajeev Shukla]

Hi Ken,
I dont understand why you have to go through the syslog to get the entries of people doing su - where you already have a logfile recording all these
Have a look at /var/adm/sulog file that will have all entries in the format you like.

[Ranjith_5]

/var/adm/sulog is already logging in the su sessions for all users.

#grep klxprod /var/adm/sulog>/tmp/sulist.txt

the above will give you su information related to the user klxprod.

Regards,
Syam

[Muthukumar_5 · Accepted solution]

You can do it as,

Change sulog file permission as,

1. chmod 644 /var/adm/sulog

Change syslog.conf configuration as,

/etc/syslog.conf
*.auth /var/adm/syslog/syslog.log

Restart syslog daemon as,

/sbin/init.d/syslogd stop
/sbin/init.d/syslogd start

In Home Directory of klmprod,

1. vi .profile
(tail -1 /var/adm/sulog
grep 'klmprod' /var/adm/syslog/syslog.conf | tail -1) >> klmprod.log

For every login to klmprod with su login informations from syslog.log and sulog will be stored in klmprod.log file.

hth.

[Ernesto Cappello]

Hi Ken looks that:

more /var/adm/sulog | grep klxprod

Regards, Ernesto.

[KPS]

Thanks everyone, I'm aware of the sulog being the best fit for getting this info in /var/adm, but there were some unique reasons here why I can't use it that would take me too long too explain.

We have some ideas however on how we'll proceed and thanks to you all....