Log Files

[AL_3001]

Gurus,

A simple question, but at times get tricky.

I do not have root access on the server, but need to check for login failure (switch user failure). As i cannot view sulog file, it requires root access, i used to check the syslog file.

The situation is, syslog file is zipped and i cannot unzip as a normal user.

Which other files contain login failure info?

Thanks.

Regards,
Ashish

[Suraj K Sankari]

hi,
login failure ?
try "lastb"

suraj

[Jozef_Novak]

No possibility to install sudo in order to get temporary root access ?

J.

[Ganesan R]

Hi Ashish,

Normally /var/adm/btmp contains all the bad logins which can be read by lastb command.

You need to check only the syslog file to know the switch user failures.

[AL_3001]

>> Suraj -> lastb requires root login

>> Jozef_Novak -> I am just a little curious, will get root access soon. Still would want to know the other locations, if any.

>> Ganesan -> btmp file cannot be read as it requires root login

[Bill Hassell]

The failed login information is stored in only one location: /var/adm/btmp and is a binary file. However, it is a security risk to set the permissions of this file to anything more open than 600. This file contains mistakes and some of them contain plain-text passwords because the user was not paying attention. The sulog has the same restrictions and should remain restricted to root only.

[Dennis Handly]

>syslog file is zipped and i cannot unzip as a normal user.

If you can read the file you can unzip it elsewhere.

[Viktor Balogh · Accepted solution]

hi,

Dennis has right. if you can read the file you can unzip it too. I recommend gzcat for reading gzipped files...

[AL_3001]

Viktor,

gzcat is correct. Thanks, it gives me my answer.

Thank You to all for their valuable inputs.

Cheers.