cancel
Showing results for 
Search instead for 
Did you mean: 

View the su logs

SOLVED
Go to solution
johnnymac_1
Advisor

View the su logs

Is there away to view a file that list all the su activity for users? This would be succesful and failed su. At a minumum what about failed su to root activity? HP-UX B.11.23.
Thanks John
6 REPLIES
Steven E. Protter
Exalted Contributor
Solution

Re: View the su logs

Shalom,

/var/adm/sulog

Any user can read them.

SEP
Steven E Protter
Owner of ISN Corporation
http://isnamerica.com
http://hpuxconsulting.com
Sponsor: http://hpux.ws
Twitter: http://twitter.com/hpuxlinux
Founder http://newdatacloud.com
Manix
Honored Contributor

Re: View the su logs

yes all logs are @ '/var/adm/sulog '

Could set up a cron job to check sulog periodically and report any failed attempts to su to root (indicated by - instead of +). This is pretty crude example, but should give you the general idea of what needs to be done.

#!/usr/bin/sh

grep "root$" /var/adm/sulog | grep " - " | mailx -s "Failed root su attempts" someone@somewhere.com

http://h30499.www3.hp.com/t5/Security/How-to-log-failed-attempts-to-ROOT/m-p/3699147#M11226

HP-UX been always lovable - Mani Kalra
johnnymac_1
Advisor

Re: View the su logs

Manix,
My sulog appears to only retain for specified period. It is cleared upon reboot and a OLDsulog file is created for the previous day. Both files only contain a 24 hour period. In order to keep a copy of all my su activity I was going to run a cron job. In Solaris cron -e edit the cron file but in HP-UX is it crontab -e? If yes are cron jobs setup pretty much the same; that is specify the time/date and file to execute?My script will create a directory with the date of the system clock, so I will need to figure out how to to this.
Manix
Honored Contributor

Re: View the su logs

please read this

http://docs.hp.com/en/B2355-90128/crontab.1.html

crontab -e

Edit a copy of your crontab file, or create an empty file to edit if the crontab file does not exist.

crontab -l

List your crontab file.

The entries in a crontab file are lines of six fields each. The fields are separated by spaces or tabs. The lines have the following format:

minute hour monthday month weekday command

example,

0 0 1,15 * 1 command
HP-UX been always lovable - Mani Kalra
johnnymac_1
Advisor

Re: View the su logs

A million thanks to both of you for your help.
Manix
Honored Contributor

Re: View the su logs

Thanks A lot

Manix
HP-UX been always lovable - Mani Kalra