topic Re: sulog in Operating System - HP-UX

sulog

Al Brown_1 — Thu, 29 Dec 2005 14:42:24 GMT

SU 06/24 23:58 + 0 root-prdadm

In the above entry what does the 0 indicate?

Re: sulog

Steven E. Protter — Thu, 29 Dec 2005 14:47:48 GMT

Shalom Al,

means user prdam di an su to root, which is user id zero.

SEP

Re: sulog

Paul Sperry — Thu, 29 Dec 2005 14:50:00 GMT

the sulog format, it's date and time and tty and then the starting user id and the id they su-ed to.

Re: sulog

James R. Ferguson — Thu, 29 Dec 2005 14:50:57 GMT

Hi:

Normally you see the device ID from which the user performed the switch in place of the "0". My guess, therefore, is that that information wasn't available for logging.

If you have logging in '/var/adm/wtmp' enabled, you might see if you could match (in the timeframe of the 'su') a login session for 'root' on 06/24 that spans 23:58 hours.

Regards!

...JRF...

Re: sulog

Al Brown_1 — Thu, 29 Dec 2005 15:29:28 GMT

Thanks James:

That is along the lines of what I thought. I suspect you are correct, we are using ssh between some systems here, which would support your guess.

Thanks also to the other gentlemen who responded, unfourtunately I really was only questioning the "0"! I understand the rest.

Al