Swicth User log in HP-UX 11i V1

[Narendra Uttekar]

Hi,
I want to find the switch user log for last year i.e.2008. But when i check in /var/adm directory i am able to find the OLDsulog and sulog but the OLDsulog has the entry starting from May 2009....Where can i find the old sulogs for 2008.

Thanks,
Narendra

[Dennis Handly]

On your backup tapes.
If CLEAN_ADM is set, /sbin/init.d/clean_adm renames the sulog.
See /etc/rc.config.d/clean.

[Pete Randall · Accepted solution]

You will have to search your backup tapes. The reboot process move /var/adm/sulog to /var/adm/OLDsulog, so each time the server is rebooted, the OLDsulog is cleared out.


Pete

[Suraj K Sankari]

Hi,

Check it with your old backup because if any user using "su" or "su -" to other user one entry is update into your /var/adm/syslog/syslog.log file

sor you need to check your old backup's tape.

Suraj

[AL_3001]

Hi Narendra,

The gurus have said it all. However, if you still want to search the old SU logs you can get it from OLDsyslog in /var/adm.

But, trust me it will have all the system logs and you will require a magnifying glass to scatter out between the logs you looking for and the ones you see there.

Regards,
AL

[Dennis Handly]

>AL: you will require a magnifying glass to scatter out between the logs you looking for and the ones you see

That's why they invented grep and scripting. :-)

[Narendra Uttekar]

Hi All,
Thanks for the solution.