Can I find IP of the person who is logging as ROOT

[expertone]

I have root acess to the server and other persons also do have.

We all loggin though our Login Id and Password. No one is using the root LOGIN ID and PASSWORD.

But in my logs what i found is some one is logging with the ROOT id, Now what I want is to find its ip.

Means the IP of the person who is logging as root.

So can any body tell me is there any way to find out. I know the root PASSWORD but I want to find out the person's ip, who is logging as root.

Thanks and regard

Ashish

P.S. This thread has been moved from Servers > General to HP-UX > sysadmin.

-HP Forum Moderator

[Jimmy Vance]

try using "last" as it shows a listing of the last logged in users and their IP/hostnames. 

[expertone]

I am not able to use last command, It is showing following errors.

#
# last -R
Invalid record size. Unable to continue ...

#
# last
Invalid record size. Unable to continue ...

what to do now.

Thanks and regard

Ashish

[Dennis Handly]

>Invalid record size. Unable to continue ...
>what to do now?

What OS version are you using?

[expertone]

its hp ux 11 iv3

[Dennis Handly]

You have a corrupt wtmps file.  How much time are you willing to spend to fix it?

See my posts in:

http://h30499.www3.hp.com/t5/System-Administration/decode-contents-of-wtmp-file/m-p/5569517

http://h30499.www3.hp.com/t5/System-Administration-Knowledge/Decoding-contents-of-wtmp-file/ta-p/5582753

Also, is anyone using su or sudo to switch to root?  There are separate logs for that.