topic Re: script help in Operating System - Linux

script help

KPS — Tue, 16 Aug 2005 20:03:07 GMT

Hi Gurus,

Looking a script to do the following:

I'd like to be able to go through the syslog and capture when anyone user does an
su - klxprod.

I'd also like to to be able to put the output of the above SU activity within the the following field format if at all possible, like the following 2 examples.

SU 07/23 22:01 + tty?? root-klxprod
SU 07/20 09:14 + ta jsmith-klxprod John Smith

Can someone please help?

-KPS

Re: script help

Rajeev Shukla — Tue, 16 Aug 2005 20:10:29 GMT

Hi Ken,
I dont understand why you have to go through the syslog to get the entries of people doing su - where you already have a logfile recording all these
Have a look at /var/adm/sulog file that will have all entries in the format you like.

Re: script help

Ranjith_5 — Tue, 16 Aug 2005 20:33:12 GMT

/var/adm/sulog is already logging in the su sessions for all users.

#grep klxprod /var/adm/sulog>/tmp/sulist.txt

the above will give you su information related to the user klxprod.

Regards,
Syam

Re: script help

Muthukumar_5 — Wed, 17 Aug 2005 01:30:01 GMT

You can do it as,

Change sulog file permission as,

1. chmod 644 /var/adm/sulog

Change syslog.conf configuration as,

/etc/syslog.conf
*.auth /var/adm/syslog/syslog.log

Restart syslog daemon as,

/sbin/init.d/syslogd stop
/sbin/init.d/syslogd start

In Home Directory of klmprod,

1. vi .profile
(tail -1 /var/adm/sulog
grep 'klmprod' /var/adm/syslog/syslog.conf | tail -1) >> klmprod.log

For every login to klmprod with su login informations from syslog.log and sulog will be stored in klmprod.log file.

hth.

Re: script help

Ernesto Cappello — Wed, 17 Aug 2005 02:19:31 GMT

Hi Ken looks that:

more /var/adm/sulog | grep klxprod

Regards, Ernesto.

Re: script help

KPS — Wed, 17 Aug 2005 07:49:06 GMT

Thanks everyone, I'm aware of the sulog being the best fit for getting this info in /var/adm, but there were some unique reasons here why I can't use it that would take me too long too explain.

We have some ideas however on how we'll proceed and thanks to you all....