tracking su's

[Steve G. Casino]

Is there a log i can view to track SUs?

Thanks in advance!

[Victor BERRIDGE · Accepted solution]

Hi,
All I can think of is /var/adm/sulog...

All the best
Victor

[Jeff_Traigle]

/var/adm/sulog and /var/adm/syslog/syslog.log. See su(1).

[Pete Randall]

Steve,

/var/adm/sulog tracks the date, time, and user who did the su.


Pete

[Geoff Wild]

Yes, /var/adm/sulog

more /var/adm/sulog
SU 07/26 10:33 + pts/7 gwild-root
SU 07/26 10:39 + pts/10 gwild-root
SU 07/26 10:39 + daemon root-oracle
SU 07/26 10:41 + daemon root-oracle
SU 07/26 11:58 - pts/11 gwild-root
SU 07/26 11:58 + pts/11 gwild-root
SU 07/28 07:16 + pts/12 gwild-root



Rgds...Geoff

[Sanjay_6]

/var/adm/sulog is a readble file. su's are also logged into syslog,

cat /var/adm/syslog/syslog.log |grep -i ": su :"
'+" is a successfule attempt and "-" is an unsuccessful one.

Hope this helps.

Regds

[Steve G. Casino]

Big help! Thanks to everyone!
This is the best forum i ever joined!
I always get an answer in less than 5 minutes