All su id i can get from syslog.log, but can you pls tell me that from where we can check that commnds executed by the user who has done su from normal userid to root.
This is what I used to do. We also modify the user .profile and make the history file with the date and time stamp. each time the user logins all the commands are logged into that file (that has date-time stamps).
The drawback of this is there are too many files created. for example if the user logs in and logs out 100 times, there are 100 files created.
if you go this route then, you may need to cron this to get rid of these files.
let me know if you need the profile I will cut and paste it.
>where we can check that commands executed by the user who has done su from normal userid to root.
You can't accurately do this. If the user does "su -", you could look at root's history file but the user could erase it. If no "-", again the user could erase his history.
One suggestion is to use sudo for "each" command so they are all logged.
i use "su -", and its geeting logged in sulog, but the other commands which i am executing (i.e. top, bdf)is not getting logged in .sh_history of root.
