Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

  • Congratulations strongm on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

A message when someone try to su root

Status
Not open for further replies.

ezradibiase

Technical User
Oct 16, 2002
19
IT
Hi,
I have a dgux 4.0f box and I would like to know if there is a way to notify the sysadmin that someone tried to su root or tried to log with the root account.

I saw how Polycenter works but I can't buy such a tool.

Thanks a lot.
Ezra
 
Try looking in /var/adm/syslog.dated/current/user.log. This should log the su. Can't remember off hand what actual information is logged. If not enough, try some of the other log files in this directory
 
Thanks mrmac228 but I find the user.log file empty instead the auth.log file contains some info:

Jun 5 07:28:03 system_name login: ROOT login on /dev/ttyp1

I haven't configured the syslog daemon and I think it doesn't work in a good way. Can syslog warn me with an email or a pop-up message? This is what I am looking for.
I haven't explained well.

Thanks!
Ezra
 
Yes,

cat /var/adm/sulog
dtaction 05/29 14:54 + ? system_name-root

Is it of any help?
Thanks.
Ezra
 
Havn;yt got acces to TRu64 but.
Server Date Time + Terminal fromuser-touser.
 
I should configure syslog, because I have only this entry...
and it was written on the 29 may 2002!!!

Thanks a lot to everyone.
Ezra
 
Status
Not open for further replies.

Part and Inventory Search

Sponsor

Back
Top