A message when someone try to su root

[ezradibiase]

Hi,
I have a dgux 4.0f box and I would like to know if there is a way to notify the sysadmin that someone tried to su root or tried to log with the root account.

I saw how Polycenter works but I can't buy such a tool.

Thanks a lot.
Ezra

 

[mrmac228]

Try looking in /var/adm/syslog.dated/current/user.log. This should log the su. Can't remember off hand what actual information is logged. If not enough, try some of the other log files in this directory

 

[ezradibiase]

Thanks mrmac228 but I find the user.log file empty instead the auth.log file contains some info:

Jun 5 07:28:03 system_name login: ROOT login on /dev/ttyp1

I haven't configured the syslog daemon and I think it doesn't work in a good way. Can syslog warn me with an email or a pop-up message? This is what I am looking for.
I haven't explained well.

Thanks!
Ezra

 

[dblair]

Is there not an sulog on Tru64?

 

[ezradibiase]

Yes,

cat /var/adm/sulog
dtaction 05/29 14:54 + ? system_name-root

Is it of any help?
Thanks.
Ezra

 

[dblair]

Havn;yt got acces to TRu64 but.
Server Date Time + Terminal fromuser-touser.

 

[ezradibiase]

I should configure syslog, because I have only this entry...
and it was written on the 29 may 2002!!!

Thanks a lot to everyone.
Ezra

 

[dblair]

HAve a look at man for su.