Sysloging from Remote Users

[Bardill]

Hi
I am a SUN Sysadmin.
Now i musst supervise a TRUE64 UNIX System.

I would like to supervise all user log in. the user which via telnet, Rlogin etz at the system announce themselves. With SUN inetd the service with t must be started and in syslog.conf auth.notice inserts to become. What has to be done with TRUE64 everything? can someone help me?

[Ralf Puchner]

there are several ways to log user logins.

First it is possible to use the old syslog.conf mechanism by adding the same keywords (man syslog.conf).
In 5.x systems you can use the evm-system by filtering sys.unix.syslog.auth events (man evm).
Or you can use the C2 subset (man secsetup)
Or you can use the audit feature (man 7 audit)

[Michael Elleby III_1]

Here is an idea that I use on the UNIX systems I support (T64 included) that might help in the short term:

I modify each user's profile to invoke a log entry each time the user logs in. Especially the root account. A few of my T64 systems, I had to give root psw to Security group, and a couple of others, so I did this to 'monitor' the login.

If I'm not mistaken, aren't ftp's logged in the auth.log file in syslog.dated directory?

Mike Elleby