sulog

[Al Brown_1]

SU 06/24 23:58 + 0 root-prdadm

In the above entry what does the 0 indicate?

[Steven E. Protter]

Shalom Al,

means user prdam di an su to root, which is user id zero.

SEP

[Paul Sperry]

the sulog format, it's date and time and tty and then the starting user id and the id they su-ed to.

[James R. Ferguson · Accepted solution]

Hi:

Normally you see the device ID from which the user performed the switch in place of the "0". My guess, therefore, is that that information wasn't available for logging.

If you have logging in '/var/adm/wtmp' enabled, you might see if you could match (in the timeframe of the 'su') a login session for 'root' on 06/24 that spans 23:58 hours.

Regards!

...JRF...

[Al Brown_1]

Thanks James:

That is along the lines of what I thought. I suspect you are correct, we are using ssh between some systems here, which would support your guess.

Thanks also to the other gentlemen who responded, unfourtunately I really was only questioning the "0"! I understand the rest.

Al